Subversion (Apache) - vulnerabilities (CVEs)

47 CVEs, 0 in the last 30 days, 199 known versions, newest CVE from 2024-12-09. Vendor: Apache.

CVEs of Subversion

CVE-2024-46901 - CVSS 4.3 (medium), 2024-12-09: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with…
CVE-2024-45720 - CVSS 8.2 (high), 2024-10-09: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to…
CVE-2022-24070 - CVSS 7.5 (high), 2022-04-12: Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory…
CVE-2021-28544 - CVSS 4.3 (medium), 2022-04-12: Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured…
CVE-2020-17525 - CVSS 7.5 (high), 2021-03-17: Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client…
CVE-2019-0203 - CVSS 7.5 (high), 2019-09-26: In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences…
CVE-2018-11782 - CVSS 6.5 (medium), 2019-09-26: In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request…
CVE-2018-11803 - CVSS 7.5 (high), 2019-02-05: Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits…
CVE-2013-4246 - CVSS 8.8 (high), 2017-10-30: libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause…
CVE-2016-8734 - CVSS 6.5 (medium), 2017-10-16: Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused…
CVE-2017-9800 - CVSS 9.8 (critical), 2017-08-11: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an…
CVE-2016-2168 - CVSS 6.5 (medium), 2016-05-05: The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote…
CVE-2016-2167 - CVSS 6.8 (medium), 2016-05-05: The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used,…
CVE-2015-5343 - CVSS 7.6 (high), 2016-04-14: Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a…
CVE-2015-5259 - CVSS 8.6 (high), 2016-01-08: Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary…
CVE-2015-3187 - CVSS 4 (medium), 2015-08-12: The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote…
CVE-2015-3184 - CVSS 5 (medium), 2015-08-12: mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access,…
CVE-2015-0251 - CVSS 4 (medium), 2015-04-08: The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a…
CVE-2015-0248 - CVSS 5 (medium), 2015-04-08: The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service…
CVE-2015-0202 - CVSS 7.8 (high), 2015-04-08: The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of…
CVE-2014-8108 - CVSS 5 (medium), 2014-12-18: The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of…
CVE-2014-3580 - CVSS 5 (medium), 2014-12-18: The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service…
CVE-2014-3504 - CVSS 4 (medium), 2014-08-19: The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not…
CVE-2014-3528 - CVSS 4 (medium), 2014-08-19: Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials,…
CVE-2014-3522 - CVSS 4 (medium), 2014-08-19: The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or…
CVE-2013-7393 - CVSS 2.4 (low), 2014-07-28: The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1)…
CVE-2013-4262 - CVSS 2.4 (low), 2014-07-28: svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a…
CVE-2014-0032 - CVSS 4.3 (medium), 2014-02-14: The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled,…
CVE-2013-4558 - CVSS 3.5 (low), 2013-12-07: The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built…
CVE-2013-4505 - CVSS 2.6 (low), 2013-12-07: The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended…
CVE-2013-4277 - CVSS 3.3 (low), 2013-09-16: Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a…
CVE-2013-4131 - CVSS 4 (medium), 2013-07-31: The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of…
CVE-2013-2088 - CVSS 7.1 (high), 2013-07-31: contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands…
CVE-2013-1968 - CVSS 5.5 (medium), 2013-07-31: Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline…
CVE-2013-2112 - CVSS 7.8 (high), 2013-07-31: The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.
CVE-2013-1849 - CVSS 4.3 (medium), 2013-05-02: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service…
CVE-2013-1847 - CVSS 5 (medium), 2013-05-02: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service…
CVE-2013-1846 - CVSS 4 (medium), 2013-05-02: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of…
CVE-2013-1884 - CVSS 5 (medium), 2013-05-02: The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and…
CVE-2013-1845 - CVSS 2.1 (low), 2013-05-02: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of…
CVE-2011-1921 - CVSS 4.3 (medium), 2011-06-06: The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit…
CVE-2011-1783 - CVSS 4.3 (medium), 2011-06-06: The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit…
CVE-2011-1752 - CVSS 5 (medium), 2011-06-06: The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service…
CVE-2011-0715 - CVSS 4.3 (medium), 2011-03-11: The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service…
CVE-2010-4644 - CVSS 3.5 (low), 2011-01-07: Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and…
CVE-2010-4539 - CVSS 6.8 (medium), 2011-01-07: The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote…
CVE-2010-3315 - CVSS 6 (medium), 2010-10-04: authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when…