CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8966 – Cross Site Scripting (XSS) flaws found in Tiki-Wiki CMS software
https://notcve.org/view.php?id=CVE-2020-8966
01 Apr 2020 — There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page. Se presenta una vulnerabilidad de Neutralización Inapropiada de Etiquetas HTML Relacionadas con Scripts en una Página Web (vulnerabilidad XSS Básica) en las páginas web php de Tiki-Wiki Groupware. Tiki-Wiki CMS todas... • https://sourceforge.net/p/tikiwiki/code/75455 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-6022
https://notcve.org/view.php?id=CVE-2013-6022
12 Feb 2020 — A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code. Se presenta una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Tiki Wiki CMG Groupware versión 11.0, por medio del id paraZeroClipboard.swf, lo que podría permitir a un usuario malicioso remoto ejecutar código arbitrario. • http://www.kb.cert.org/vuls/id/450646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2011-4336 – Tiki Wiki CMS Groupware 7.2 - 'snarf_ajax.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-4336
15 Jan 2020 — Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. Tiki Wiki CMS Groupware versión 7.0, presenta una vulnerabilidad de tipo XSS por medio del parámetro GET "ajax" en el archivo snarf_ajax.php. • https://www.exploit-db.com/exploits/35974 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 45%CPEs: 1EXPL: 1CVE-2010-4239
https://notcve.org/view.php?id=CVE-2010-4239
28 Oct 2019 — Tiki Wiki CMS Groupware 5.2 has Local File Inclusion Tiki Wiki CMS Groupware versión 5.2, tiene una Inclusión de Archivos Local. • https://access.redhat.com/security/cve/cve-2010-4239 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2010-4240
https://notcve.org/view.php?id=CVE-2010-4240
28 Oct 2019 — Tiki Wiki CMS Groupware 5.2 has XSS Tiki Wiki CMS Groupware versión 5.2, tiene una vulnerabilidad de tipo XSS • https://access.redhat.com/security/cve/cve-2010-4240 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2010-4241
https://notcve.org/view.php?id=CVE-2010-4241
28 Oct 2019 — Tiki Wiki CMS Groupware 5.2 has CSRF Tiki Wiki CMS Groupware versión 5.2, tiene una vulnerabilidad de tipo CSRF • https://access.redhat.com/security/cve/cve-2010-4241 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20719
https://notcve.org/view.php?id=CVE-2018-20719
15 Jan 2019 — In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter. En Tiki en versiones anteriores a la 17.2, el componente "user task" es vulnerable a una inyección SQL mediante el parámetro show_history en tiki-user_tasks.php. • https://blog.ripstech.com/2018/scan-verify-patch-security-issues-in-minutes • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-14849
https://notcve.org/view.php?id=CVE-2018-14849
13 Aug 2018 — Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php. Tiki en versiones anteriores a la 18.2, 15.7 y 12.14 tiene Cross-Site Scripting (XSS) mediante los atributos link relacionados con lib/core/WikiParser/OutputLink.php y lib/parser/parserlib.php. • http://www.openwall.com/lists/oss-security/2018/08/02/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-14850
https://notcve.org/view.php?id=CVE-2018-14850
13 Aug 2018 — Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image. Vulnerabilidades Cross-Site Scripting (XSS) persistente en Tiki en versiones anteriores a la 18.2, 15.7 y 12.14 permiten que un usuario autenticado inyecte código JavaScript para obtener privilegios de administrador si un administrador abre una página wiki y mueve... • http://www.openwall.com/lists/oss-security/2018/08/02/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2018-7290
https://notcve.org/view.php?id=CVE-2018-7290
09 Mar 2018 — Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. Existe Cross-Site Scripting (XSS) en Tiki, en versiones anteriores a la 12.13, 15.6, 17.2 y la 18.1. • http://www.openwall.com/lists/oss-security/2018/03/08/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •