I'm in the process of an internal company application certification, one part of it is the TortoiseSVN client.
The test team got the latest official stable 220.127.116.11085-x64, they found 2 low and 1 medium "vulnerability".
I would like to kindly ask if you can have a look at them one by one (will do 3 separate posts, as suggested in the report FAQ), and if there is a possibility to adjust for this.
Vulnerability: Security Feature not Enabled
Description: The test team observed that "CFG and/or "DEP" security feature are disabled for some of the DLLs.
Screenshot attached with a couple of examples of the bin installation directory.
The test team mentioned to me that low vulnerabilities can be justified if it cannot be managed to change or has been applied for specific reasons.
Any help is much appreciated.