https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:09:20 +0000 https://cve.radiocsirt.org/vuln/cve-2017-9800 <p><strong>Affected:</strong> Apache Software Foundation Apache Subversion</p> <p>A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server&#39;s repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Subversion</p> <p>A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server&#39;s repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.</p> https://cve.radiocsirt.org/vuln/cve-2017-9800 https://cve.radiocsirt.org/vuln/usn-3388-1 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: subversion, Ubuntu:16.04:LTS: subversion</p> <p>Joern Schneeweisz discovered that Subversion did not properly handle host names in &#39;svn+ssh://&#39; URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. (CVE-2017-9800)</p> <p>Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167)</p> <p>Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: subversion, Ubuntu:16.04:LTS: subversion</p> <p>Joern Schneeweisz discovered that Subversion did not properly handle host names in &#39;svn+ssh://&#39; URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. (CVE-2017-9800)</p> <p>Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167)</p> <p>Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)</p> https://cve.radiocsirt.org/vuln/usn-3388-1