CVSS: 10.0EPSS: 3%CPEs: 13EXPL: 1CVE-2008-5305 – TWiki 4.x - 'SEARCH' Remote Command Execution
https://notcve.org/view.php?id=CVE-2008-5305
10 Dec 2008 — Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. Vulnerabilidad de inyección "eval" en TWiki y versiones anteriores a 4.2.4 que permite a los atacantes remotos ejecutar arbitrariamente código Perl a través de la variable %SEARCH{}%. • https://www.exploit-db.com/exploits/32645 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4998
https://notcve.org/view.php?id=CVE-2008-4998
07 Nov 2008 — postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this vulnerability, stating "this bug is invalid. ** DISPUTADA ** postinst en twiki v.4.1.2 permite a usuarios locales sobrescribir ficheros de su elección a través de un ataque de enlace simbólico al fichero temporal /tmp/twiki. NOTA: El fabricantes ha disputado esta vulnerabilidad, manteniendo "este error es inválido". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494648 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 51%CPEs: 13EXPL: 2CVE-2008-3195 – TWiki 4.2.0 - 'configure' Remote File Disclosure
https://notcve.org/view.php?id=CVE-2008-3195
17 Sep 2008 — Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en bin/configure en TWiki anterior a v4.2.3, cuando algún paso en el asistente de instalación es omitido, permite a atacantes remotos leer ficheros de su elección a través d... • https://www.exploit-db.com/exploits/6269 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2007-5193
https://notcve.org/view.php?id=CVE-2007-5193
04 Oct 2007 — The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied. La configuración por defecto para twiki 4.1.2 en Debian GNU/Linux, y posiblemente en otros sistemas operativos, especifican el directorio de área de trabajo (cfg{RCS}{WorkAreaDir}) bajo la raíz de los documentos ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=444982 •
CVSS: 9.8EPSS: 1%CPEs: 13EXPL: 1CVE-2006-3336
https://notcve.org/view.php?id=CVE-2006-3336
05 Jul 2006 — TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory. Vulnerabilidad en TWiki desde la versión del 01-Dic-2000 hasta la versión v4.0.3 que permite a atacantes remotos saltarse el "upload filter" (filtro o control de subida) y ejecutar código de s... • http://secunia.com/advisories/20992 •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2006-1387
https://notcve.org/view.php?id=CVE-2006-1387
26 Mar 2006 — TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory consumption) via INCLUDE by URL statements that form a loop, such as a page that includes itself. • http://secunia.com/advisories/19410 •