| Package | Affected versions | Patched versions |
|---|---|---|
| mercurial | ≤ 1.0.1 |
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free