Vulnerabilities > Twiki
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2011-05-20 | CVE-2011-1838 | Cross-Site Scripting vulnerability in Twiki Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via the origurl parameter to a (1) view script or (2) login script. | 4.3 |
| 2010-10-18 | CVE-2010-3841 | Cross-Site Scripting vulnerability in Twiki Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script. | 4.3 |
| 2010-09-07 | CVE-2009-4898 | Cross-Site Request Forgery (CSRF) vulnerability in Twiki Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the ACTION attribute of a FORM element, in conjunction with a call to the submit method in the onload attribute of a BODY element. | 6.8 |
| 2009-04-30 | CVE-2009-1339 | Cross-Site Request Forgery (CSRF) vulnerability in Twiki Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the SRC attribute of an IMG element, a related issue to CVE-2009-1434. | 6.0 |
| 2008-12-10 | CVE-2008-5305 | Code Injection vulnerability in Twiki Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. | 10.0 |
| 2008-12-10 | CVE-2008-5304 | Cross-Site Scripting vulnerability in Twiki Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. | 4.3 |
| 2008-09-18 | CVE-2008-3195 | Path Traversal vulnerability in Twiki Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. | 6.8 |
| 2007-10-04 | CVE-2007-5193 | Information Disclosure vulnerability in Twiki 4.1.2 The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied. | 5.0 |
| 2007-02-08 | CVE-2007-0669 | Unspecified vulnerability in Twiki Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files. | 4.6 |
| 2006-12-02 | CVE-2006-6071 | Information Disclosure vulnerability in TWiki Failed Login TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password. | 9.0 |