| Max CVSS | 6.8 | Min CVSS | 4.3 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2006-5442 | 6.8 |
ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view.
|
17-10-2018 - 21:42 | 21-10-2006 - 00:07 | |
| CVE-2008-1291 | 4.3 |
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder.
|
20-08-2009 - 05:14 | 24-03-2008 - 17:44 | |
| CVE-2008-1292 | 4.3 |
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only
|
20-08-2009 - 05:14 | 24-03-2008 - 17:44 | |
| CVE-2008-1290 | 4.3 |
ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information.
|
20-08-2009 - 05:14 | 24-03-2008 - 17:44 |