CVE-2025-54141 | High | 7.5 | 2025-07-22 | ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py… |
CVE-2023-22464 | Medium | 5.4 | 2023-01-04 | ViewVC is a browser interface for CVS and Subversion version control repositories. Versions prior to 1.2.3 and 1.1.30 are vulnerable to cross-site scripting. T… |
CVE-2023-22456 | Medium | 6.1 | 2023-01-03 | ViewVC, a browser interface for CVS and Subversion version control repositories, as a cross-site scripting vulnerability that affects versions prior to 1.2.2 a… |
CVE-2020-5283 | Low | 3.1 | 2020-04-03 | ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need f… |
CVE-2007-5743 | High | 7.5 | 2019-11-07 | viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option. |
CVE-2017-5938 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to i… |
CVE-2012-4533 | | | 2012-11-19 | Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x be… |
CVE-2012-3357 | | | 2012-07-22 | The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreada… |
CVE-2012-3356 | | | 2012-07-22 | The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to… |
CVE-2009-5024 | | | 2011-05-23 | ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via th… |
CVE-2010-0132 | | | 2010-03-31 | Cross-site scripting (XSS) vulnerability in ViewVC 1.1 before 1.1.5 and 1.0 before 1.0.11, when the regular expression search functionality is enabled, allows… |
CVE-2010-0736 | | | 2010-03-19 | Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attacke… |
CVE-2010-0005 | | | 2010-01-29 | query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remo… |
CVE-2010-0004 | | | 2010-01-29 | ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root name… |
CVE-2009-3619 | | | 2009-11-10 | Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter n… |
CVE-2009-3618 | | | 2009-11-10 | Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or… |
CVE-2008-4325 | | | 2008-09-30 | lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attacke… |
CVE-2008-1292 | | | 2008-03-24 | ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive informa… |
CVE-2008-1291 | | | 2008-03-24 | ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list fold… |
CVE-2008-1290 | | | 2008-03-24 | ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sen… |
CVE-2006-5442 | | | 2006-10-21 | ViewVC 1.0.2 and earlier does not specify a charset in its HTTP headers or HTML documents, which allows remote attackers to conduct cross-site scripting (XSS)… |