CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8966 – Cross Site Scripting (XSS) flaws found in Tiki-Wiki CMS software
https://notcve.org/view.php?id=CVE-2020-8966
01 Apr 2020 — There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page. Se presenta una vulnerabilidad de Neutralización Inapropiada de Etiquetas HTML Relacionadas con Scripts en una Página Web (vulnerabilidad XSS Básica) en las páginas web php de Tiki-Wiki Groupware. Tiki-Wiki CMS todas... • https://sourceforge.net/p/tikiwiki/code/75455 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-6022
https://notcve.org/view.php?id=CVE-2013-6022
12 Feb 2020 — A Cross-Site Scripting (XSS) vulnerability exists in Tiki Wiki CMG Groupware 11.0 via the id paraZeroClipboard.swf, which could let a remote malicious user execute arbitrary code. Se presenta una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Tiki Wiki CMG Groupware versión 11.0, por medio del id paraZeroClipboard.swf, lo que podría permitir a un usuario malicioso remoto ejecutar código arbitrario. • http://www.kb.cert.org/vuls/id/450646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2011-4336 – Tiki Wiki CMS Groupware 7.2 - 'snarf_ajax.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-4336
15 Jan 2020 — Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. Tiki Wiki CMS Groupware versión 7.0, presenta una vulnerabilidad de tipo XSS por medio del parámetro GET "ajax" en el archivo snarf_ajax.php. • https://www.exploit-db.com/exploits/35974 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20719
https://notcve.org/view.php?id=CVE-2018-20719
15 Jan 2019 — In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter. En Tiki en versiones anteriores a la 17.2, el componente "user task" es vulnerable a una inyección SQL mediante el parámetro show_history en tiki-user_tasks.php. • https://blog.ripstech.com/2018/scan-verify-patch-security-issues-in-minutes • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7188
https://notcve.org/view.php?id=CVE-2018-7188
16 Feb 2018 — An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php. Una vulnerabilidad de XSS (mediante una imagen SVG) en Tiki, en versiones anteriores a la 18, permite que un usuario autenticado obtenga privilegios de administrador si un administrador abre una página de wiki con una imagen SVG maliciosa. Esto está relacionado con lib/filegals/filegal... • http://openwall.com/lists/oss-security/2018/02/16/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7394
https://notcve.org/view.php?id=CVE-2016-7394
06 Feb 2018 — tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. tiki wiki cms groupware, en versiones iguales o anteriores a la 15.2, tiene una vulnerabilidad de XSS que permite que atacantes roben las cookies de los usuarios. • https://sourceforge.net/p/tikiwiki/code/59653 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 3%CPEs: 24EXPL: 1CVE-2011-4551 – Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection
https://notcve.org/view.php?id=CVE-2011-4551
01 Oct 2012 — Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en tiki-cookie-jar.php en TikiWiki CMS/Groupware, antes de v8.2 y LTS antes de v6.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros de su elección. • https://www.exploit-db.com/exploits/36470 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 77%CPEs: 2EXPL: 5CVE-2012-0911 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-0911
12 Jul 2012 — TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function. TikiWiki CMS/Groupware anterior a v6.7 LTS... • https://www.exploit-db.com/exploits/19573 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 17%CPEs: 24EXPL: 5CVE-2012-3996 – Tiki Wiki CMS Groupware 8.3 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-3996
12 Jul 2012 — TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php. TikiWiki CMS/Groupware v8.3 y anteriores permite a atacantes remotos obtener la ruta de instalación mediante una peticion a (1) admin/include_calendar.php, (2) tiki-rss_error.php, o (3) tiki-watershed_service.php. • https://www.exploit-db.com/exploits/19573 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2003-1574
https://notcve.org/view.php?id=CVE-2003-1574
24 Aug 2009 — TikiWiki 1.6.1 allows remote attackers to bypass authentication by entering a valid username with an arbitrary password, possibly related to the Internet Explorer "Remember Me" feature. NOTE: some of these details are obtained from third party information. TikiWiki v1.6.1 permite a usuarios remotos evitar la autenticación introduciendo un nombre de usuario válido con un password arbitrario. Vulnerabilidad posiblemente relacionada con la característica "Remember Me" de Internet Explorer. NOTA: algunos de los... • http://sourceforge.net/tracker/index.php?func=detail&aid=748739&group_id=64258&atid=506846 • CWE-287: Improper Authentication •