CVE-2009-1339

CVE-2009-1339 describes a CSRF vulnerability in TWiki prior to 4.3.1 where a remote authenticated user can hijack another user’s session for page-update requests (demonstrated via a URL in an IMG SRC attribute). Related entries note this was not fully fixed by prior patches, with CVE-2009-4898 ci...

FreeBSD : twiki -- arbitrary shell command execution (b4af3ede-36e9-11d9-a9e7-0001020eed82)

Hans Ulrich Niedermann reports : The TWiki search function uses a user-supplied search string to compose a command line executed by the Perl backtick operator. The search string is not checked properly for shell metacharacters and is thus vulnerable to search string containing quotes and shell...

FreeBSD : twiki -- multiple vulnerabilities (f98dea27-d687-11dd-abd1-0050568452ac)

Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report : XSS vulnerability with URLPARAM variable SEARCH variable allows arbitrary shell command execution %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. VID f98dea27-d687-11dd-abd1-0050568452ac OpenVAS Vulnerability Test $ Description: Auto generated from VID f98dea27-d687-11dd-abd1-0050568452ac Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Design/Logic Flaw

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH% variable...

CVE-2008-5304

Cross-site scripting XSS vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM% variable...

Cross site scripting

Cross-site scripting XSS vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM% variable...

CVE-2008-5305

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH% variable...

CVE-2008-5304

Cross-site scripting XSS vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM% variable...

CVE-2008-5305

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH% variable...

CVE-2008-5305

TWiki before 4.2.4 is vulnerable to an eval injection via the %SEARCH{}% variable, enabling remote arbitrary Perl code execution. Impact: remote attacker can execute code; exploitation is possible without authentication. Remediation: upgrade to TWiki 4.2.4 or later (or apply vendor-provided fix) ...

CVE-2008-5304

TWiki is affected by CVE-2008-5304: a cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. Affected product/version: TWiki

CVE-2008-5304

Cross-site scripting XSS vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM% variable...

CVE-2008-5305

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH% variable...

Twiki < 4.2.4 Multiple Vulnerabilities

Binary data 4780.prm...

TWiki 4.x - URLPARAM Cross-Site Scripting

TWiki 4.x - URLPARAM Cross-Site Scripting source: https://www.securityfocus.com/bid/32669/info TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser o...

TWiki 4.x - SEARCH Remote Command Execution

TWiki 4.x - SEARCH Remote Command Execution source: https://www.securityfocus.com/bid/32668/info TWiki is prone to a vulnerability that attackers can leverage to execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize...

TWiki 4.x - 'SEARCH' Remote Command Execution

source: https://www.securityfocus.com/bid/32668/info TWiki is prone to a vulnerability that attackers can leverage to execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize user-supplied input. Successful attacks can...

TWiki 4.x - 'URLPARAM' Cross-Site Scripting

source: https://www.securityfocus.com/bid/32669/info TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...