338 matches found
twiki -- multiple vulnerabilities
Marc Schoenefeld and Steve Milner of RedHat SRT and Peter Allor of IBM ISS report: XSS vulnerability with URLPARAM variable SEARCH variable allows arbitrary shell command execution...
Insecure tempfile handling Vulnerability in TWiki (Sep 2008)
TWiki is prone to an insecure temp file handling vulnerability. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:twiki:twiki";...
CVE-2008-4998
postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this vulnerability, stating "this bug is invalid...
CVE-2008-4998
postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this vulnerability, stating "this bug is invalid...
Design/Logic Flaw
postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this vulnerability, stating "this bug is invalid...
CVE-2008-4998
CVE-2008-4998 affects TWiki 4.1.2: the postinst script allows a local user to overwrite arbitrary files via a symlink attack on /tmp/twiki. Multiple connected sources corroborate the issue, with vendor dispute noting the bug is invalid. The documents do not specify a fix or mitigations. The explo...
CVE-2008-4998
postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this vulnerability, stating "this bug is invalid...
PT-2008-6168 · Twiki · Twiki
Name of the Vulnerable Software and Affected Versions: twiki version 4.1.2 Description: The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. The vendor disputes this issue, stating it is invalid. Recommendations: For twiki version 4.1.2,...
Gentoo Security Advisory GLSA 200411-33 (www-apps/twiki)
The remote host is missing updates announced in advisory GLSA 200411-33. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Debian Security Advisory DSA 1639-1 (twiki)
The remote host is missing an update to twiki announced via advisory DSA 1639-1. OpenVAS Vulnerability Test $Id: deb16391.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1639-1 twiki Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
Debian: Security Advisory (DSA-1639-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Gentoo Security Advisory GLSA 200411-33 (www-apps/twiki)
The remote host is missing updates announced in advisory GLSA 200411-33. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-1639-1 : twiki - command execution
It was discovered that twiki, a web-based collaboration platform, didn't properly sanitize the image parameter in its configuration script. This could allow remote users to execute arbitrary commands upon the system, or read any files which were readable by the webserver user. %NASLMINLEVEL 70300...
TWiki <= 4.2.2 (action) Remote Code Execution Vulnerability
No description provided by source. -----------webDEViL - w3bd3vil at gmail dot com ----------- -----------TWiki Remote Code Execution = 4.2.2-------------------- ----------developers site: http://www.twiki.org------------------- ----------CVE Ids : CVE-2008-3195--------------------------...
twiki-exec.txt
-----------webDEViL - w3bd3vil at gmail dot com ----------- -----------TWiki Remote Code Execution header-type = $query-param'type'; So use this instead: print 'Content-type: '.$query-param'type'."\n\n"; if openF, 'logos/'.$query-param'image' local $/ = undef; print ; closeF;...
TWiki <= 4.2.2 (action) Remote Code Execution Vulnerability
Exploit for cgi platform in category web applications =========================================================== TWiki header-type = $query-param'type'; So use this instead: print 'Content-type: '.$query-param'type'."\n\n"; if openF, 'logos/'.$query-param'image' local $/ = undef; print ; closeF;...
TWiki 4.2.2 - action Remote Code Execution
TWiki 4.2.2 - action Remote Code Execution -----------webDEViL - w3bd3vil at gmail dot com ----------- -----------TWiki Remote Code Execution header-type = $query-param'type'; So use this instead: print 'Content-type: '.$query-param'type'."\n\n"; if openF, 'logos/'.$query-param'image' local $/ =...
TWiki 4.2.2 - 'action' Remote Code Execution
-----------webDEViL - w3bd3vil at gmail dot com ----------- -----------TWiki Remote Code Execution header-type = $query-param'type'; So use this instead: print 'Content-type: '.$query-param'type'."\n\n"; if openF, 'logos/'.$query-param'image' local $/ = undef; print ; closeF;...
[SECURITY] [DSA 1639-1] New twiki packages execution of arbitrary code
------------------------------------------------------------------------ Debian Security Advisory DSA-1639-1 [email protected] http://www.debian.org/security/ Steve Kemp September 19, 2008 http://www.debian.org/security/faq -...
