Fossil-scm Fossil 2.18

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:fossil-scm:fossil:2.18:*:*:*:*:*:*:*

part: a version: 2.18 update: *

VendorFossil Scm (d2a97783-4805-5fe7-836f-4a56626f6543)
ProductFossil (c1fcc7bf-2b42-54b2-95d2-d61036a6745f)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/fossil purl2cpe 2026-06-01 10:17:00.262790
pkg:deb/ubuntu/fossil purl2cpe 2026-06-01 10:17:00.262792
pkg:github/drhsqlite/fossil-mirror purl2cpe 2026-06-01 10:17:00.262793
pkg:github/wilsoncrespo/fossil_scm purl2cpe 2026-06-01 10:17:00.262794
pkg:rpm/fedora/fossil purl2cpe 2026-06-01 10:17:00.262796
pkg:rpm/opensuse/fossil purl2cpe 2026-06-01 10:17:00.262797

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-34009 vulnerable 2026-06-08 05:44:51.988881 Details available
Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.
Published: 2022-07-27T23:23:51.000Z
Updated: 2024-08-03T08:16:16.194Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.