CVSS: 4.3EPSS: 0%CPEs: 40EXPL: 1CVE-2009-1482
https://notcve.org/view.php?id=CVE-2009-1482
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en action/AttachFile.py en MoinMoin v1.8.2 y anteriores permiten a atacantes remotos inyectar HTML o scripts web arbitrarios a través de (1) una sub-acción AttachFile en la función error_msg o (2) múltiples vectores relacionados con los errores de empaquetado de ficheros en la función upload_form, diferentes vectores que CVE-2009-0260. • http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1 http://moinmo.in/SecurityFixes http://secunia.com/advisories/34821 http://secunia.com/advisories/34945 http://secunia.com/advisories/35024 http://www.debian.org/security/2009/dsa-1791 http://www.securityfocus.com/bid/34631 http://www.ubuntu.com/usn/USN-774-1 http://www.vupen.com/english/advisories/2009/1119 https://exchange.xforce.ibmcloud.com/vulnerabilities/50356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0312
https://notcve.org/view.php?id=CVE-2009-0312
Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la característica antispam (security/antispam.py) en MoinMoin 1.7 y 1.8.1, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de un contenido rechazado, manipulado. • http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad http://moinmo.in/SecurityFixes#moin1.8.1 http://osvdb.org/51632 http://secunia.com/advisories/33716 http://secunia.com/advisories/33755 http://www.openwall.com/lists/oss-security/2009/01/27/4 https://exchange.xforce.ibmcloud.com/vulnerabilities/48306 https://usn.ubuntu.com/716-1 https://www.debian.org/security/2009/dsa-1715 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 2CVE-2009-0260 – MoinMoin 1.8 - 'AttachFile.py' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-0260
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable). Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en action/AttachFile.py en MoinMoin antes de v1.8.1, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante una acción AttachFile a el componente WikiSandBox con los parámetros (1) rename o (2) drawing (alias la variable basename). • https://www.exploit-db.com/exploits/32746 http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1 http://moinmo.in/SecurityFixes#moin1.8.1 http://osvdb.org/51485 http://secunia.com/advisories/33593 http://secunia.com/advisories/33716 http://secunia.com/advisories/33755 http://www.securityfocus.com/archive/1/500197/100/0/threaded http://www.securityfocus.com/bid/33365 http://www.vupen.com/english/advisories/2009/0195 https://exchange.xforce.ibmcloud.com/vulnerabilities/48126 h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 3CVE-2008-3381
https://notcve.org/view.php?id=CVE-2008-3381
Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados en macro/AdvancedSearch.py en moin (y MoinMoin)1.6.3 y 1.7.0, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través vectores no especificados. • http://hg.moinmo.in/moin/1.6/rev/8686a10f1f58 http://hg.moinmo.in/moin/1.7/rev/383196922b03 http://moinmo.in/SecurityFixes http://secunia.com/advisories/31135 http://www.securityfocus.com/bid/30297 http://www.vupen.com/english/advisories/2008/2147/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43899 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 3EXPL: 1CVE-2008-1937
https://notcve.org/view.php?id=CVE-2008-1937
The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges. El procesamiento del formulario "user" (userform.py) en MoinMoin anterior a 1.6.3, cuando emplea ACLs o una lista de superusuarios que no está vacía, no gestiona correctamente los usuarios lo que permite a atacantes remotos obtener privilegios. • http://hg.moinmo.in/moin/1.6/rev/f405012e67af http://moinmo.in/SecurityFixes http://secunia.com/advisories/29894 http://secunia.com/advisories/30160 http://security.gentoo.org/glsa/glsa-200805-09.xml http://www.securityfocus.com/bid/28869 http://www.vupen.com/english/advisories/2008/1307/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41909 • CWE-264: Permissions, Privileges, and Access Controls •