CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 2CVE-2009-0260 – MoinMoin 1.8 - 'AttachFile.py' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-0260
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable). Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en action/AttachFile.py en MoinMoin antes de v1.8.1, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante una acción AttachFile a el componente WikiSandBox con los parámetros (1) rename o (2) drawing (alias la variable basename). • https://www.exploit-db.com/exploits/32746 http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1 http://moinmo.in/SecurityFixes#moin1.8.1 http://osvdb.org/51485 http://secunia.com/advisories/33593 http://secunia.com/advisories/33716 http://secunia.com/advisories/33755 http://www.securityfocus.com/archive/1/500197/100/0/threaded http://www.securityfocus.com/bid/33365 http://www.vupen.com/english/advisories/2009/0195 https://exchange.xforce.ibmcloud.com/vulnerabilities/48126 h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 3EXPL: 1CVE-2008-1937
https://notcve.org/view.php?id=CVE-2008-1937
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges. El procesamiento del formulario "user" (userform.py) en MoinMoin anterior a 1.6.3, cuando emplea ACLs o una lista de superusuarios que no está vacía, no gestiona correctamente los usuarios lo que permite a atacantes remotos obtener privilegios. • http://hg.moinmo.in/moin/1.6/rev/f405012e67af http://moinmo.in/SecurityFixes http://secunia.com/advisories/29894 http://secunia.com/advisories/30160 http://security.gentoo.org/glsa/glsa-200805-09.xml http://www.securityfocus.com/bid/28869 http://www.vupen.com/english/advisories/2008/1307/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41909 • CWE-264: Permissions, Privileges, and Access Controls •