CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2018-7290
https://notcve.org/view.php?id=CVE-2018-7290
09 Mar 2018 — Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1. Existe Cross-Site Scripting (XSS) en Tiki, en versiones anteriores a la 12.13, 15.6, 17.2 y la 18.1. • http://www.openwall.com/lists/oss-security/2018/03/08/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7303
https://notcve.org/view.php?id=CVE-2018-7303
21 Feb 2018 — The Calendar component in Tiki 17.1 allows HTML injection. El componente Calendar en Tiki 17.1 permite la inyección HTML. • https://websecnerd.blogspot.in/2018/01/tiki-wiki-cms-groupware-17.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7188
https://notcve.org/view.php?id=CVE-2018-7188
16 Feb 2018 — An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php. Una vulnerabilidad de XSS (mediante una imagen SVG) en Tiki, en versiones anteriores a la 18, permite que un usuario autenticado obtenga privilegios de administrador si un administrador abre una página de wiki con una imagen SVG maliciosa. Esto está relacionado con lib/filegals/filegal... • http://openwall.com/lists/oss-security/2018/02/16/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7394
https://notcve.org/view.php?id=CVE-2016-7394
06 Feb 2018 — tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. tiki wiki cms groupware, en versiones iguales o anteriores a la 15.2, tiene una vulnerabilidad de XSS que permite que atacantes roben las cookies de los usuarios. • https://sourceforge.net/p/tikiwiki/code/59653 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.0EPSS: 0%CPEs: 21EXPL: 0CVE-2017-14924
https://notcve.org/view.php?id=CVE-2017-14924
29 Sep 2017 — Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php. Una vulnerabilidad de Cross-Site Request Forgery (CSRF) mediante un elemento IMG en Tiki en versiones anteriores a 16.3, las versiones 17.x anteriores a 17.1, 12 LTS anteriores a 12.12 LTS y 15 LTS en ver... • http://openwall.com/lists/oss-security/2017/09/28/13 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.0EPSS: 0%CPEs: 21EXPL: 0CVE-2017-14925
https://notcve.org/view.php?id=CVE-2017-14925
29 Sep 2017 — Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site. Una vulnerabilidad de Cross-Site Request Forgery (CSRF) mediante un elemento IMG en Tiki en versi... • http://openwall.com/lists/oss-security/2017/09/28/13 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2017-9145
https://notcve.org/view.php?id=CVE-2017-9145
26 Jun 2017 — TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS. TikiFilter.php en Tiki Wiki CMS Groupware de las versiones 12.x hasta las 16.x no valida correctamente los parámetros imgsize o lang para evitar Cross-Site Scripting (XSS). • https://sourceforge.net/p/tikiwiki/code/62386 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9305
https://notcve.org/view.php?id=CVE-2017-9305
31 May 2017 — lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php. lib/core /TikiFilter/PreventXss.php en Tiki Wiki CMS Groupware 16.2 permitiría a un atacante remoto pasar por alto el filtro XSS a través de caracteres de relleno cero, como lo demuestra un ataque a tiki-batch_send_newsletter.php. • https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10143 – Tiki Wiki CMS 15.2 Arbitrary File Read
https://notcve.org/view.php?id=CVE-2016-10143
20 Jan 2017 — A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. Una vulnerabilidad en Tiki Wiki CMS 15.2 podría permitir a un atacante remoto leer archivos arbitrarios en un sistema objetivo a través de un nombre de ruta manipulado en un campo URL banner. Tiki Wiki CMS version 15.2 suffers from an arbitrary file read vulnerability. • http://www.securityfocus.com/bid/96787 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2016-9889
https://notcve.org/view.php?id=CVE-2016-9889
23 Dec 2016 — Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. Algunas formas con el parámetro geo_zoomlevel_to_found_location en Tiki Wiki CMS 12.x en versiones anteriores a 12.10 LTS, 15.x en versiones anteriores a 15.3 LTS y 16.x en versiones anteriores a 16.1 no tienen la entrada desinfectada, relacionada con tiki-setup.php ... • http://www.securityfocus.com/bid/95083 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •