CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7394
https://notcve.org/view.php?id=CVE-2016-7394
tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. tiki wiki cms groupware, en versiones iguales o anteriores a la 15.2, tiene una vulnerabilidad de XSS que permite que atacantes roben las cookies de los usuarios. • https://sourceforge.net/p/tikiwiki/code/59653 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 3%CPEs: 24EXPL: 5CVE-2012-3996 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-3996
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php. TikiWiki CMS/Groupware v8.3 y anteriores permite a atacantes remotos obtener la ruta de instalación mediante una peticion a (1) admin/include_calendar.php, (2) tiki-rss_error.php, o (3) tiki-watershed_service.php. • https://www.exploit-db.com/exploits/19573 https://www.exploit-db.com/exploits/19630 http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html http://dev.tiki.org/item4109 http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS http://info.tiki.org/article191-Tiki-Releases-8-4 http://www.exploit-db.com/exploits/19573 http://www.exploit-db.com/exploits/19630 http://www.osvdb.org/83533 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 94%CPEs: 2EXPL: 5CVE-2012-0911 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-0911
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function. TikiWiki CMS/Groupware anterior a v6.7 LTS y anterior a v8.4 permite a atacantes remotos ejecutar código arbitrario PHP mediante un objeto serializado manipulado en el parámetro (1) cookieName para lib/banners/bannerlib.php; (2) printpages o (3) el parámetro printstructures para (a) tiki-print_multi_pages.php o (b) tiki-print_pages.php; o (4) sendpages, (5) sendstructures, o (6) el parámetro sendarticles para to tiki-send_objects.php, el cual no es correctamente procesado por la función unserialize Tiki Wiki CMS Groupware versions 8.3 and below suffer from an unserialize() PHP code execution vulnerability. • https://www.exploit-db.com/exploits/19573 https://www.exploit-db.com/exploits/19630 http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html http://dev.tiki.org/item4109 http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS http://info.tiki.org/article191-Tiki-Releases-8-4 http://osvdb.org/83534 http://www.exploit-db.com/exploits/19573 http://www.exploit-db.com/exploits/19630 http://www.securityfocus.com/bid/54298 https://exchang • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 1CVE-2011-4551 – Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection
https://notcve.org/view.php?id=CVE-2011-4551
Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en tiki-cookie-jar.php en TikiWiki CMS/Groupware, antes de v8.2 y LTS antes de v6.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros de su elección. Tiki Wiki CMS Groupware versions 8.1 and 6.4 LTS suffer from a stored cross site scripting vulnerability. • https://www.exploit-db.com/exploits/36470 http://info.tiki.org/article183-Tiki-Wiki-CMS-Groupware-8-2-and-6-5LTS-Security-Patches-Available http://secunia.com/advisories/47278 http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-07.txt http://www.osvdb.org/77966 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2010-1135
https://notcve.org/view.php?id=CVE-2010-1135
The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse. La función user_logout en TikiWiki CMS/Groupware v4.x anteriores a v4.2 no borra de forma adecuada las cookies de login del usuario, lo que permite a atacantes remotos obtener acceso a traves de reutilizar la cookie. • http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases http://secunia.com/advisories/38896 http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25046 http://www.securityfocus.com/bid/38608 https://exchange.xforce.ibmcloud.com/vulnerabilities/56770 • CWE-255: Credentials Management Errors •