CVSS: 5.0EPSS: 0%CPEs: 29EXPL: 2CVE-2010-0287 – dokuwiki 2009-12-25 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-0287
Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter. Vulnerabilidad de salto de directorio en el plugin ACL Manager (plugins/acl/ajax.php) de DokuWiki en versiones anteriores a la v2009-12-25b permite a usuarios remotos listar los contenidos de directorios de su elección a través de .. (punto punto) en el parámetro ns. • https://www.exploit-db.com/exploits/11141 http://bugs.splitbrain.org/index.php?do=details&task_id=1847 http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html http://secunia.com/advisories/38183 http://security.gentoo.org/glsa/glsa-201301-07.xml http://www.debian.org/security/2010/dsa-1976 http://www.exploit-db.com/exploits/11141 http://www.securityfocus.com/bid/37821 http& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 29EXPL: 2CVE-2010-0288 – dokuwiki 2009-12-25 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-0288
A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010. Una errata en el check del permiso de administrador del plugin ACL Manager (plugins/acl/ajax.php) de DokuWiki en versiones anteriores a la v2009-12-25b permite a atacantes remotos obtener privlegios y acceder a wikis cerrados editando las restricciones de ACL actuales, como se ha demostrado en Enero del 2010. • https://www.exploit-db.com/exploits/11141 http://bugs.splitbrain.org/index.php?do=details&task_id=1847 http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html http://osvdb.org/61710 http://secunia.com/advisories/38183 http://security.gentoo.org/glsa/glsa-201301-07.xml http://www.debian.org/security/2010/dsa-1976 http://www.exploit-db.com/exploits/11141 http://www.s • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 29EXPL: 0CVE-2010-0289
https://notcve.org/view.php?id=CVE-2010-0289
Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el plugin ACL Manager (plugins/acl/ajax.php) de DokuWiki en versiones anteriores a la v2009-12-25c. Permiten a atacantes remotos secuestrar la autenticación de los administradores para peticiones que modifican el acceso a las reglas de control de acceso, y otras peticiones sin especificar, a través de vectores de ataque desconocidos. • http://bugs.splitbrain.org/index.php?do=details&task_id=1853 http://freshmeat.net/projects/dokuwiki/tags/security-fix http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034729.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034831.html http://osvdb.org/61708 http://secunia.com/advisories/38205 http://security.gentoo.org/glsa/glsa-201301-07.xml http://www.debian.org/security/2010/dsa-1976 http://www.splitbrain.org/blog/2010-01/17-dok • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 1%CPEs: 27EXPL: 1CVE-2006-4675
https://notcve.org/view.php?id=CVE-2006-4675
Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors. Vulnerabilidad de actualización de archivo no restringida en lib/exe/media.php en DokuWiki anterior a 09/03/2006 permite a un atacante remoto actualizar archivos ejecutables dentro de la carpeta data/media a través de vectores no especificados. • http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html http://secunia.com/advisories/21819 http://secunia.com/advisories/21936 http://security.gentoo.org/glsa/glsa-200609-10.xml http://securityreason.com/securityalert/1537 http://www.securityfocus.com/archive/1/445516/100/0/threaded •
CVSS: 7.5EPSS: 1%CPEs: 27EXPL: 1CVE-2006-4674
https://notcve.org/view.php?id=CVE-2006-4674
Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php. Vulnerabilidad de inyección de código estático directo en doku.php en DokuWiki anterior a 30/09/2006 permite a un atacante remoto ejecutar código PHP de su elección a través de la cabecera X-FORWARDED-FOR HTTP, la cual está almancenada en config.php. • http://bugs.splitbrain.org/index.php?do=details&id=906 http://retrogod.altervista.org/dokuwiki_2006-03-09b_cmd.html http://secunia.com/advisories/21819 http://secunia.com/advisories/21936 http://security.gentoo.org/glsa/glsa-200609-10.xml http://securityreason.com/securityalert/1537 http://www.securityfocus.com/archive/1/445516/100/0/threaded •