Piwik < 1.1.0 Multiple Vulnerabilities

Binary data 5743.prm...

CVE-2011-0398

The PiwikCommon::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via 1 use of a private aka RFC 1918 address behind a proxy server or 2 spoofing of the X-Forwarded-For HTTP...

CVE-2011-0399

Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-0004

Multiple cross-site scripting XSS vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0400

Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2011-0401

Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service inode consumption by establishing many sessions...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service inode consumption by establishing many sessions...

Hardcoded credentials

Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

Design/Logic Flaw

The PiwikCommon::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via 1 use of a private aka RFC 1918 address behind a proxy server or 2 spoofing of the X-Forwarded-For HTTP...

Session fixation

Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2011-0399

Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2011-0400

CVE-2011-0400 affects Piwik prior to 1.1. Cookie.php fails to set the secure flag on the session cookie in HTTPS sessions, enabling potential interception of the session cookie over HTTP. This is the nature and impact as described; no remediation details are provided in the referenced documents.

CVE-2011-0004

Multiple cross-site scripting XSS vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0401

Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service inode consumption by establishing many sessions...

CVE-2011-0401

Piwik before 1.1 allows unlimited files under tmp/sessions, enabling a DoS via inode consumption from numerous sessions. Affected component: Piwik core (session file handling). Root cause: the product does not properly limit the number of files stored in tmp/sessions/. Impact: potential denial of...

CVE-2011-0398

CVE-2011-0398 affects Piwik before version 1.1. The vulnerability is in the Piwik_Common::getIP function, which does not correctly determine the client IP address. This can allow remote attackers to bypass geolocation restrictions and logging by either: using a private (RFC 1918) address behind a...

CVE-2011-0004

Multiple cross-site scripting XSS vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-0398

The PiwikCommon::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via 1 use of a private aka RFC 1918 address behind a proxy server or 2 spoofing of the X-Forwarded-For HTTP...

CVE-2011-0400

Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...