Fossil SCM is a lightweight, self-contained distributed version control system designed for small to medium-sized projects, with a minimal and focused product portfolio. The observed disclosures associated with this vendor center on its core repository and synchronization functionality, where vulnerability context remains incompletely characterized in available databases. Current exposure counts and severity figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fossil Scm over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-24614HIGH Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the r | Aug 25, 2020 | 8.8 | 29 | NO | NO |
CVE-2017-17459HIGH http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash c | Dec 7, 2017 | 8.8 | 28 | NO | NO |
CVE-2021-36377HIGH Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation. | Jul 12, 2021 | 7.5 | 25 | NO | NO |
CVE-2022-34009MEDIUM Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary fil | Jul 28, 2022 | 5.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fossil Scm.
Media articles that mention a CVE ID that affects a product developed by Fossil Scm — matched by CVE ID, not by vendor name.