Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 48

Export CSV
CVE-2016-2168

subversion: DoS in mod_authz_svn during COPY/MOVE authorization check

The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.

CVSS 3.0 · 6.5 Medium EPSS 20.7% KEV · Not listed
Vendors
Apache
Products
Subversion
CVE-2013-4505

subversion: mod_dontdothat does not block requests from certain clients

The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.

CVSS 2.0 · 2.6 Low EPSS 7.9% KEV · Not listed
Vendors
Apache
Products
Mod Dontdothat Subversion
CVE-2013-1968

format): Filenames with newline character can lead to revision corruption

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.

CVSS 2.0 · 5.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Apache Canonical Collabnet and 2 more
Products
Subversion Ubuntu Linux Subversion and 2 more
CVE-2013-2088

subversion: Improper sanitization of arguments of certain hook scripts might lead to arbitrary code execution

contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

CVSS 2.0 · 7.1 High EPSS 31.5% KEV · Not listed
Vendors
Apache Collabnet Opensuse
Products
Subversion Subversion Opensuse
CVE-2013-2112

subversion: Remote DoS due improper handling of early-closing TCP connections

The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.

CVSS 2.0 · 7.8 High EPSS 3.9% KEV · Not listed
Vendors
Apache Canonical Collabnet and 2 more
Products
Subversion Ubuntu Linux Subversion and 2 more
CVE-2013-4131

subversion: DoS (assertion failure, crash) in mod_dav_svn when handling certain MOVE, COPY, or DELETE HTTP requests

The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.

CVSS 2.0 · 4.0 Medium EPSS 4.4% KEV · Not listed
Vendors
Apache
Products
Subversion
CVE-2011-1752

(mod_dav_svn): DoS (crash) via request to deliver baselined WebDAV resources

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.

CVSS 2.0 · 5.0 Medium EPSS 8.5% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Subversion Mac Os X Ubuntu Linux and 3 more
CVE-2013-4277

subversion: svnserve is vulnerable to symlink attack

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Subversion
CVE-2013-4558

subversion: mod_dav_svn assertion when handling certain requests with autoversioning enabled

The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.

CVSS 2.0 · 3.5 Low EPSS 5.9% KEV · Not listed
Vendors
Apache
Products
Mod Dav Svn Subversion
CVE-2014-0032

subversion: mod_dav_svn crash when handling certain requests with SVNListParentPath on

The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.

CVSS 2.0 · 4.3 Medium EPSS 11.1% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2011-0715

(mod_dav_svn): DoS (NULL ptr deref) by a lock token sent from a not authenticated Subversion client

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.

CVSS 2.0 · 4.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2010-3315

Subversion: Access restriction bypass by checkout of the root of the repository

authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.

CVSS 2.0 · 6.0 Medium EPSS 4.2% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2010-4644

Subversion: DoS (memory consumption) by processing blame or log -g requests on certain files

Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

CVSS 2.0 · 3.5 Low EPSS 4.5% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2010-4539

(mod_dav_svn): DoS (crash) by processing certain requests to display all available repositories to a web browser

The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.

CVSS 2.0 · 6.8 Medium EPSS 5.1% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2011-1783

(mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.

CVSS 2.0 · 4.3 Medium EPSS 6.7% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Subversion Mac Os X Ubuntu Linux and 3 more
CVE-2011-1921

(mod_dav_svn): File contents disclosure of files configured to be unreadable by those users

The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.

CVSS 2.0 · 4.3 Medium EPSS 6.0% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2013-1845

(mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.

CVSS 2.0 · 2.1 Low EPSS 5.9% KEV · Not listed
Vendors
Apache Opensuse Redhat
Products
Subversion Opensuse Enterprise Linux
CVE-2013-1846

(mod_dav_svn): DoS (crash) via LOCK requests against an activity URL

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.

CVSS 2.0 · 4.0 Medium EPSS 6.7% KEV · Not listed
Vendors
Apache Opensuse Redhat
Products
Subversion Opensuse Enterprise Linux
CVE-2013-1847

(mod_dav_svn): DoS (crash) via LOCK requests against a non-existent URL

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 51.4% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2013-1849

(mod_dav_svn): DoS (crash) via PROPFIND request made against activity URLs

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.

CVSS 2.0 · 4.3 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux