CVE-2009-3618

Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter. NOTE: some of these details are obtained from third party information.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
• http://osvdb.org/56997
• http://secunia.com/advisories/36292Vendor Advisory
• http://secunia.com/advisories/36311Vendor Advisory
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.2/CHANGES?revision=2235&pathrev=HEAD
• http://www.openwall.com/lists/oss-security/2009/10/16/10
• http://www.vupen.com/english/advisories/2009/2257Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52430
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00557.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00566.html
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
• http://osvdb.org/56997
• http://secunia.com/advisories/36292Vendor Advisory
• http://secunia.com/advisories/36311Vendor Advisory
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.2/CHANGES?revision=2235&pathrev=HEAD
• http://www.openwall.com/lists/oss-security/2009/10/16/10
• http://www.vupen.com/english/advisories/2009/2257Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52430
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00557.html
• https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00566.html

Published

Nov 10, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3612The tcf_fill_node function in net/sched/cls_api.c in the net…
• CVE-2009-3613The swiotlb functionality in the r8169 driver in drivers/net…
• CVE-2009-3614liboping 1.3.2 allows users reading arbitrary files upon the…3.3
• CVE-2009-3615The OSCAR protocol plugin in libpurple in Pidgin before 2.6.…
• CVE-2009-3616Multiple use-after-free vulnerabilities in vnc.c in the VNC …9.9
• CVE-2009-3617Format string vulnerability in the AbstractCommand::onAbort …
• CVE-2009-3619Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1…
• CVE-2009-3620The ATI Rage 128 (aka r128) driver in the Linux kernel befor…7.8
• CVE-2009-3621net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier …5.5
• CVE-2009-3622Algorithmic complexity vulnerability in wp-trackback.php in …
• CVE-2009-3623The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the…
• CVE-2009-3624The get_instantiation_keyring function in security/keys/keyc…