CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9305
https://notcve.org/view.php?id=CVE-2017-9305
lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php. lib/core /TikiFilter/PreventXss.php en Tiki Wiki CMS Groupware 16.2 permitiría a un atacante remoto pasar por alto el filtro XSS a través de caracteres de relleno cero, como lo demuestra un ataque a tiki-batch_send_newsletter.php. • https://github.com/tikiorg/tiki/commit/6c016e8f066d2f404b18eaa1af7fa0c7a9651ccd https://www.cdxy.me/?p=763 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10143
https://notcve.org/view.php?id=CVE-2016-10143
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. Una vulnerabilidad en Tiki Wiki CMS 15.2 podría permitir a un atacante remoto leer archivos arbitrarios en un sistema objetivo a través de un nombre de ruta manipulado en un campo URL banner. • http://www.securityfocus.com/bid/96787 https://dev.tiki.org/item6174 https://sourceforge.net/p/tikiwiki/code/60308 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2016-9889
https://notcve.org/view.php?id=CVE-2016-9889
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. Algunas formas con el parámetro geo_zoomlevel_to_found_location en Tiki Wiki CMS 12.x en versiones anteriores a 12.10 LTS, 15.x en versiones anteriores a 15.3 LTS y 16.x en versiones anteriores a 16.1 no tienen la entrada desinfectada, relacionada con tiki-setup.php y article_image.php. El impacto es XSS • http://www.securityfocus.com/bid/95083 http://www.securitytracker.com/id/1037531 https://tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2013-4714
https://notcve.org/view.php?id=CVE-2013-4714
Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-site scripting (XSS) en Tiki Wiki CMS Groupware 6 LTS antes 6.13LTS, 9 LTS antes 9.7LTS, 10.x antes de 10.4, 11.x anterior a 11.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados . • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware http://jvn.jp/en/jp/JVN81813850/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2013-000099 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2013-4715
https://notcve.org/view.php?id=CVE-2013-4715
SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Tiki Wiki CMS Groupware 6 LTS anterior a 6.13LTS, 9 LTS anterior 9.7LTS, 10.x anterior a 10.4, 11.x anterior a 11.1 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware http://jvn.jp/en/jp/JVN75720314/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2013-000100 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •