Page 5 of 69 results (0.013 seconds)

CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0

CVE-2013-4715

https://notcve.org/view.php?id=CVE-2013-4715

SQL injection vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Tiki Wiki CMS Groupware 6 LTS anterior a 6.13LTS, 9 LTS anterior 9.7LTS, 10.x anterior a 10.4, 11.x anterior a 11.1 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://info.tiki.org/article221-New-Versions-of-all-supported-versions-of-Tiki-Wiki-CMS-Groupware http://jvn.jp/en/jp/JVN75720314/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2013-000100 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.8EPSS: 1%CPEs: 1EXPL: 5

CVE-2012-5321 – Tiki Wiki CMS Groupware - 'url' Open Redirection

https://notcve.org/view.php?id=CVE-2012-5321

tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection." tiki-featured_link.php en TikiWiki CMS/Groupware 8.3, permite a atacantes remotos para cargar arbitrarias páginas del sitio web en marcos y llevar a cabo ataques de phishing a través del parámetro url, también conocido como "inyección de marco". • https://www.exploit-db.com/exploits/36848 https://github.com/Cappricio-Securities/CVE-2012-5321 http://osvdb.org/79409 http://secunia.com/advisories/48102 http://st2tea.blogspot.com/2012/02/tiki-wiki-cms-groupware-frame-injection.html http://www.securityfocus.com/bid/52079 http://www.securitytracker.com/id?1026708 https://exchange.xforce.ibmcloud.com/vulnerabilities/73403 • CWE-20: Improper Input Validation •

CVSS: 5.0EPSS: 3%CPEs: 24EXPL: 5

CVE-2012-3996 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution

https://notcve.org/view.php?id=CVE-2012-3996

TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php. TikiWiki CMS/Groupware v8.3 y anteriores permite a atacantes remotos obtener la ruta de instalación mediante una peticion a (1) admin/include_calendar.php, (2) tiki-rss_error.php, o (3) tiki-watershed_service.php. • https://www.exploit-db.com/exploits/19573 https://www.exploit-db.com/exploits/19630 http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html http://dev.tiki.org/item4109 http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS http://info.tiki.org/article191-Tiki-Releases-8-4 http://www.exploit-db.com/exploits/19573 http://www.exploit-db.com/exploits/19630 http://www.osvdb.org/83533 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 94%CPEs: 2EXPL: 5

CVE-2012-0911 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution

https://notcve.org/view.php?id=CVE-2012-0911

TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function. TikiWiki CMS/Groupware anterior a v6.7 LTS y anterior a v8.4 permite a atacantes remotos ejecutar código arbitrario PHP mediante un objeto serializado manipulado en el parámetro (1) cookieName para lib/banners/bannerlib.php; (2) printpages o (3) el parámetro printstructures para (a) tiki-print_multi_pages.php o (b) tiki-print_pages.php; o (4) sendpages, (5) sendstructures, o (6) el parámetro sendarticles para to tiki-send_objects.php, el cual no es correctamente procesado por la función unserialize Tiki Wiki CMS Groupware versions 8.3 and below suffer from an unserialize() PHP code execution vulnerability. • https://www.exploit-db.com/exploits/19573 https://www.exploit-db.com/exploits/19630 http://archives.neohapsis.com/archives/bugtraq/2012-07/0020.html http://dev.tiki.org/item4109 http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS http://info.tiki.org/article191-Tiki-Releases-8-4 http://osvdb.org/83534 http://www.exploit-db.com/exploits/19573 http://www.exploit-db.com/exploits/19630 http://www.securityfocus.com/bid/54298 https://exchang • CWE-502: Deserialization of Untrusted Data •

CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 1

CVE-2011-4551 – Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection

https://notcve.org/view.php?id=CVE-2011-4551

Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en tiki-cookie-jar.php en TikiWiki CMS/Groupware, antes de v8.2 y LTS antes de v6.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros de su elección. Tiki Wiki CMS Groupware versions 8.1 and 6.4 LTS suffer from a stored cross site scripting vulnerability. • https://www.exploit-db.com/exploits/36470 http://info.tiki.org/article183-Tiki-Wiki-CMS-Groupware-8-2-and-6-5LTS-Security-Patches-Available http://secunia.com/advisories/47278 http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-07.txt http://www.osvdb.org/77966 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •