FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  529982
Date:      2020-03-31
Time:      15:52:41Z
Committer: tijl

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
71597e3e-f6b8-11dd-94d9-0030843d3802websvn -- multiple vulnerabilities

Secunia reports:

Some vulnerabilities have been reported in WebSVN, which can be exploited by malicious users to disclose sensitive information, and by malicious people to conduct cross-site scripting attacks and manipulate data.

Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Input passed to the "rev" parameter in rss.php is not properly sanitised before being used. This can be exploited to overwrite arbitrary files via directory traversal attacks.

Access to restricted repositories is not properly enforced, which can be exploited to disclose potentially sensitive information by accessing the repository via "listing.php" and using the "compare with previous" and "show changed files" links.


Discovery 2008-10-23
Entry 2009-02-09
websvn
lt 2.1.0

CVE-2008-5918
CVE-2008-5919
CVE-2009-0240
http://secunia.com/advisories/32338/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191
http://www.gulftech.org/?node=research&article_id=00132-10202008
71597e3e-f6b8-11dd-94d9-0030843d3802websvn -- multiple vulnerabilities

Secunia reports:

Some vulnerabilities have been reported in WebSVN, which can be exploited by malicious users to disclose sensitive information, and by malicious people to conduct cross-site scripting attacks and manipulate data.

Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Input passed to the "rev" parameter in rss.php is not properly sanitised before being used. This can be exploited to overwrite arbitrary files via directory traversal attacks.

Access to restricted repositories is not properly enforced, which can be exploited to disclose potentially sensitive information by accessing the repository via "listing.php" and using the "compare with previous" and "show changed files" links.


Discovery 2008-10-23
Entry 2009-02-09
websvn
lt 2.1.0

CVE-2008-5918
CVE-2008-5919
CVE-2009-0240
http://secunia.com/advisories/32338/
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191
http://www.gulftech.org/?node=research&article_id=00132-10202008
12d1b5a6-e39d-11e5-9f77-5453ed2e2b49websvn -- reflected cross-site scripting

Sebastien Delafond reports:

Jakub Palaczynski discovered that websvn, a web viewer for Subversion repositories, does not correctly sanitize user-supplied input, which allows a remote user to run reflected cross-site scripting attacks.


Discovery 2016-02-22
Entry 2016-03-06
websvn
lt 2.3.3_1

CVE-2016-2511
https://lists.debian.org/debian-security-announce/2016/msg00060.html
http://seclists.org/fulldisclosure/2016/Feb/99
f69e1f09-e39b-11e5-9f77-5453ed2e2b49websvn -- information disclosure

Thijs Kinkhorst reports:

James Clawson reported:

"Arbitrary files with a known path can be accessed in websvn by committing a symlink to a repository and then downloading the file (using the download link).

An attacker must have write access to the repo, and the download option must have been enabled in the websvn config file."


Discovery 2015-01-18
Entry 2016-03-06
websvn
lt 2.3.3_1

CVE-2013-6892
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-6892
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775682