CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2017-9145
https://notcve.org/view.php?id=CVE-2017-9145
TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS. TikiFilter.php en Tiki Wiki CMS Groupware de las versiones 12.x hasta las 16.x no valida correctamente los parámetros imgsize o lang para evitar Cross-Site Scripting (XSS). • https://sourceforge.net/p/tikiwiki/code/62386 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9305
https://notcve.org/view.php?id=CVE-2017-9305
lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php. lib/core /TikiFilter/PreventXss.php en Tiki Wiki CMS Groupware 16.2 permitiría a un atacante remoto pasar por alto el filtro XSS a través de caracteres de relleno cero, como lo demuestra un ataque a tiki-batch_send_newsletter.php. • https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd https://www.cdxy.me/?p=763 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10143
https://notcve.org/view.php?id=CVE-2016-10143
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. Una vulnerabilidad en Tiki Wiki CMS 15.2 podría permitir a un atacante remoto leer archivos arbitrarios en un sistema objetivo a través de un nombre de ruta manipulado en un campo URL banner. • http://www.securityfocus.com/bid/96787 https://dev.tiki.org/item6174 https://sourceforge.net/p/tikiwiki/code/60308 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2016-9889
https://notcve.org/view.php?id=CVE-2016-9889
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. Algunas formas con el parámetro geo_zoomlevel_to_found_location en Tiki Wiki CMS 12.x en versiones anteriores a 12.10 LTS, 15.x en versiones anteriores a 15.3 LTS y 16.x en versiones anteriores a 16.1 no tienen la entrada desinfectada, relacionada con tiki-setup.php y article_image.php. El impacto es XSS • http://www.securityfocus.com/bid/95083 http://www.securitytracker.com/id/1037531 https://tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2013-4714
https://notcve.org/view.php?id=CVE-2013-4714
Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-site scripting (XSS) en Tiki Wiki CMS Groupware 6 LTS antes 6.13LTS, 9 LTS antes 9.7LTS, 10.x antes de 10.4, 11.x anterior a 11.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados . • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware http://jvn.jp/en/jp/JVN81813850/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2013-000099 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •