ViewVC 1.0.2 and previous versions does not specify a charset in its HTTP headers or HTML documents, which allows remote malicious users to conduct cross-site scripting (XSS) attacks that inject arbitrary UTF-7 encoded JavaScript code via a view.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
viewvc viewvc |