CVE-2012-4533

Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.

• CWE-79

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062Issue Tracking, Mailing List, Third Party Advisory
• http://osvdb.org/86566Broken Link
• http://secunia.com/advisories/51041Third Party Advisory
• http://secunia.com/advisories/51072Third Party Advisory
• http://viewvc.tigris.org/issues/show_bug.cgi?id=515Third Party Advisory
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792Third Party Advisory
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794Third Party Advisory
• http://www.debian.org/security/2012/dsa-2563Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:134Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/21/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/21/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/56161Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79561Third Party Advisory, VDB Entry
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313Third Party Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062Issue Tracking, Mailing List, Third Party Advisory
• http://osvdb.org/86566Broken Link
• http://secunia.com/advisories/51041Third Party Advisory
• http://secunia.com/advisories/51072Third Party Advisory
• http://viewvc.tigris.org/issues/show_bug.cgi?id=515Third Party Advisory
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.0.13/CHANGES
• http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/tags/1.1.16/CHANGES
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2792Third Party Advisory
• http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2794Third Party Advisory
• http://www.debian.org/security/2012/dsa-2563Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:134Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/21/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/21/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/56161Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79561Third Party Advisory, VDB Entry
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0313Third Party Advisory

Published

Nov 19, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4527Stack-based buffer overflow in mcrypt 2.6.8 and earlier allo…
• CVE-2012-4528The mod_security2 module before 2.7.0 for the Apache HTTP Se…
• CVE-2012-4529The org.apache.catalina.connector.Response.encodeURL method …
• CVE-2012-4530The load_script function in fs/binfmt_script.c in the Linux …
• CVE-2012-4531Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x be…
• CVE-2012-4532Cross-site scripting (XSS) vulnerability in modules/mod_lang…
• CVE-2012-4534org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat…
• CVE-2012-4535Xen 3.4 through 4.2, and possibly earlier versions, allows l…
• CVE-2012-4536The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq fun…
• CVE-2012-4537Xen 3.4 through 4.2, and possibly earlier versions, does not…
• CVE-2012-4538The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2…
• CVE-2012-4539Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64…