GCVE - cpe:2.3:a:edgewall_software:trac:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:edgewall_software:trac:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Edgewall Software (`172a4250-ad58-53ba-8c19-3896b1ce215d`)
Product	Trac (`3578c37f-7bd4-526d-86de-3375f3ec3455`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/edgewall/trac`	purl2cpe	2026-06-01 10:12:32.561297
`pkg:pypi/trac`	purl2cpe	2026-06-01 10:12:32.561299

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-0394`	not_vulnerable	2026-06-08 04:52:02.132007	Details available PyGIT.py in the Trac Git plugin (trac-git) before 0.0.20080710-3+lenny1 and before 0.0.20090320-1 on Debian GNU/Linux, when enabled in Trac, allows remote attackers to execute arbitrary commands via shell metacharacters in a crafted HTTP query that is used to generate a certain git command. Published: 2010-02-10T02:00:00.000Z Updated: 2024-08-07T00:45:12.238Z Open on db.gcve.eu Reference links http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567039 http://secunia.com/advisories/38325 http://www.securityfocus.com/bid/38076 http://www.debian.org/security/2010/dsa-1990 https://exchange.xforce.ibmcloud.com/vulnerabilities/56105	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3328`	vulnerable	2026-06-08 04:50:34.122120	Details available Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. Published: 2008-07-27T22:00:00.000Z Updated: 2024-08-07T09:37:26.950Z Open on db.gcve.eu Reference links https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01270.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01261.html http://www.securityfocus.com/bid/30400 https://exchange.xforce.ibmcloud.com/vulnerabilities/44016 http://secunia.com/advisories/31231	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-5878`	vulnerable	2026-06-08 04:49:21.573317	Details available Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors. Published: 2006-11-14T19:00:00.000Z Updated: 2024-08-07T20:04:55.766Z Open on db.gcve.eu Reference links http://security.gentoo.org/glsa/glsa-200612-14.xml http://secunia.com/advisories/22789 http://www.debian.org/security/2006/dsa-1209 http://secunia.com/advisories/23357 http://www.vupen.com/english/advisories/2006/4422	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-3695`	vulnerable	2026-06-08 04:49:09.972606	Details available Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458. Published: 2006-07-19T01:00:00.000Z Updated: 2024-08-07T18:39:53.571Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/27706 http://www.vupen.com/english/advisories/2006/2729 http://secunia.com/advisories/20958 http://securitytracker.com/id?1016457 http://www.securityfocus.com/bid/18323	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Trac

Notes

PURL mappings

Vulnerability references

Contribute