CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12980
https://notcve.org/view.php?id=CVE-2017-12980
DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as demonstrated by the dc:creator element. DokuWiki en su versión 2017-02-19c tiene XSS almacenado cuando presenta un canal RSS o Atom malicioso, en /inc/parser/xhtml.php. Un atacante puede crear o editar una wiki que emplee datos RSS o Atom desde un servidor controlado por el atacante para desencadenar la ejecución de JavaScript. • https://github.com/splitbrain/dokuwiki/issues/2081 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12583
https://notcve.org/view.php?id=CVE-2017-12583
DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. La versión 2017-02-19b de DokuWiki tiene una vulnerabilidad de tipo XSS en el parámetro at (o variable DATE_AT) al doku.php. • https://github.com/splitbrain/dokuwiki/issues/2061 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-7965
https://notcve.org/view.php?id=CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server). DokuWiki 2016-06-26a y versiones más antiguas utiliza $_SERVER[HTTP_HOST] en lugar del ajuste baseurl como parte de la URL de restablecimiento de contraseña. • http://www.securityfocus.com/bid/94237 https://github.com/splitbrain/dokuwiki/issues/1709 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-2172
https://notcve.org/view.php?id=CVE-2015-2172
DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API. DokuWiki en versiones anteriores a 2014-05-05d y en versiones anteriores a 2014-09-29c no comprueba correctamente los permisos para los plugins ACL, lo que permite a usuarios remotos autenticados ganar privilegios y añadir o eliminar reglas ACL a través de una solicitud a la API XMLRPC. • http://advisories.mageia.org/MGASA-2015-0093.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152994.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153062.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153266.html http://www.openwall.com/lists/oss-security/2015/03/02/2 http://www.securityfocus.com/bid/72827 https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f https://github.com/splitbrain/dokuwiki • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9253
https://notcve.org/view.php?id=CVE-2014-9253
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php. La configuración de la lista blanca del tipo de ficheros por defecto en conf/mime.conf en Media Manager en DokuWiki anterior a 2014-09-29b permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarios mediante la subida de un fuchero SWF, posteriormente el acceso a ello a través del parámetro media en lib/exe/fetch.php. • http://advisories.mageia.org/MGASA-2014-0540.html http://seclists.org/oss-sec/2014/q4/1050 http://security.szurek.pl/dokuwiki-20140929a-xss.html http://www.securityfocus.com/bid/71671 http://www.securitytracker.com/id/1031369 https://exchange.xforce.ibmcloud.com/vulnerabilities/99291 https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960 https://www.dokuwiki.org/changes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •