CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 1CVE-2015-2793
https://notcve.org/view.php?id=CVE-2015-2793
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi. Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo templates/openid-selector.tmpl en ikiwiki versiones anteriores a 3.20150329, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro openid_identifier en una acción de comprobación para el archivo ikiwiki.cgi. • http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157001.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157023.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157025.html http://openwall.com/lists/oss-security/2015/03/30/5 http://openwall.com/lists/oss-security/2015/03/31/1 http://source.ikiwiki.branchable.com/?p=source.git%3Ba=commitdiff%3Bh=18dfba868fe2fb9c64706b2123eb0b3a3ce66a77 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 0%CPEs: 4EXPL: 0CVE-2011-1408
https://notcve.org/view.php?id=CVE-2011-1408
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. ikiwiki versiones anteriores a 3.20110608, permite a atacantes remotos secuestrar tty de root y ejecutar ataques de tipo symlink. • https://ikiwiki.info/security/#index40h2 https://security-tracker.debian.org/tracker/CVE-2011-1408 https://snyk.io/vuln/SNYK-LINUX-IKIWIKI-133098 https://www.tenable.com/plugins/nessus/55157 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-9187
https://notcve.org/view.php?id=CVE-2019-9187
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs. ikiwiki anterior a versión 3.20170111.1 y versión 3.2018x y versión 3.2019x anterior a 3.20190228, permite SSRF por medio del plugin aggregate. El impacto también incluye la lectura de archivos locales por medio de archivos: URIs. • https://ikiwiki.info/news https://ikiwiki.info/news/version_3.20190228 https://lists.debian.org/debian-lts-announce/2019/03/msg00018.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9646 – Commit metadata forgery via CGI::FormBuilder context-dependent APIs
https://notcve.org/view.php?id=CVE-2016-9646
ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery. ikiwiki, en versiones anteriores a la 3.20161229, llamó incorrectamente al método CGI::FormBuilder->field (similar a la API CGI->param que desembocó en el CVE-2014-1572 de Bugzilla), que puede aprovecharse para falsificar metadatos del commit. • https://ikiwiki.info/security/#cve-2016-9646 https://marc.info/?l=oss-security&m=148304341511854&w=2 https://security-tracker.debian.org/tracker/CVE-2016-9646 https://www.debian.org/security/2017/dsa-3760 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 1CVE-2017-0356 – Authentication bypass via repeated parameters
https://notcve.org/view.php?id=CVE-2017-0356
A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters. Existe un error similar a CVE-2016-9646 en ikiwiki, en versiones anteriores a la 3.20170111, en el uso del plugin passwordauth de CGI::FormBuilder. Esto permite que un atacante omita la autenticación mediante parámetros repetidos. • http://www.securityfocus.com/bid/95420 https://ikiwiki.info/security/#cve-2017-0356 https://marc.info/?l=oss-security&m=148418234314276&w=2 https://www.debian.org/security/2017/dsa-3760 • CWE-287: Improper Authentication •