CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12979
https://notcve.org/view.php?id=CVE-2017-12979
DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element, in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution. DokuWiki en su versión 2017-02-19c tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) cuando presenta un nombre de lenguaje malicioso en un elemento del código en /inc/parser/xhtml.php. Un atacante puede crear o editar una wiki con este elemento para desencadenar la ejecución de JavaScript. • https://github.com/splitbrain/dokuwiki/issues/2080 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-12583
https://notcve.org/view.php?id=CVE-2017-12583
DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php. La versión 2017-02-19b de DokuWiki tiene una vulnerabilidad de tipo XSS en el parámetro at (o variable DATE_AT) al doku.php. • https://github.com/splitbrain/dokuwiki/issues/2061 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-7965
https://notcve.org/view.php?id=CVE-2016-7965
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server). DokuWiki 2016-06-26a y versiones más antiguas utiliza $_SERVER[HTTP_HOST] en lugar del ajuste baseurl como parte de la URL de restablecimiento de contraseña. • http://www.securityfocus.com/bid/94237 https://github.com/splitbrain/dokuwiki/issues/1709 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9253
https://notcve.org/view.php?id=CVE-2014-9253
The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php. La configuración de la lista blanca del tipo de ficheros por defecto en conf/mime.conf en Media Manager en DokuWiki anterior a 2014-09-29b permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarios mediante la subida de un fuchero SWF, posteriormente el acceso a ello a través del parámetro media en lib/exe/fetch.php. • http://advisories.mageia.org/MGASA-2014-0540.html http://seclists.org/oss-sec/2014/q4/1050 http://security.szurek.pl/dokuwiki-20140929a-xss.html http://www.securityfocus.com/bid/71671 http://www.securitytracker.com/id/1031369 https://exchange.xforce.ibmcloud.com/vulnerabilities/99291 https://github.com/splitbrain/dokuwiki/commit/778ddf6f2cd9ed38b9db2d73e823b8c21243a960 https://www.dokuwiki.org/changes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8761
https://notcve.org/view.php?id=CVE-2014-8761
inc/template.php in DokuWiki before 2014-05-05a only checks for access to the root namespace, which allows remote attackers to access arbitrary images via a media file details ajax call. inc/template.php en DokuWiki anterior a 2014-05-05a solamente comprueba para el acceso al espacio de nombre root, lo que permite a atacantes remotos acceder a imágenes arbitrarias a través de una llamada ajax para detalles de ficheros de los medios. • http://advisories.mageia.org/MGASA-2014-0438.html http://secunia.com/advisories/61983 http://www.debian.org/security/2014/dsa-3059 http://www.openwall.com/lists/oss-security/2014/10/13/3 http://www.openwall.com/lists/oss-security/2014/10/16/9 https://bugs.dokuwiki.org/index.php?do=details&task_id=2647#comment6204 https://github.com/splitbrain/dokuwiki/issues/765 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •