Tigris operates a narrowly scoped portfolio centered on Subversion-related tools, principally WebSVN and TortoiseSVN, which serve as web-based and Windows-integrated interfaces to version control repositories. The vendor's disclosures cluster around application-layer and input-handling weaknesses—code injection, path traversal, cross-site scripting, and weak cryptographic random generation—that reflect the parsing and user-input demands of web-facing and shell-integrated tools. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tigris over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2008-5920HIGH The create_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg_replace function w | Jan 21, 2009 | 7.5 | 29 | NO | YES |
CVE-2008-5919MEDIUM Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to overwrite arbitrary files via directory traver | Jan 21, 2009 | 6.8 | 29 | NO | YES |
CVE-2010-3199HIGH Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hija | Sep 10, 2010 | 9.3 | 27 | NO | NO |
CVE-2024-31497MEDIUM In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures | Apr 15, 2024 | 5.9 | 24 | NO | NO |
CVE-2008-5918MEDIUM Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attackers to inject arbitrary web script or HT | Jan 21, 2009 | 4.3 | 22 | NO | YES |
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified | Jan 21, 2009 | 3.5 | 13 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tigris.
Media articles that mention a CVE ID that affects a product developed by Tigris — matched by CVE ID, not by vendor name.