CVE-2008-3195

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. dot dot in the image variable, and execute arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. dot dot in the image variable, and execute arbitrary files via unspecified vectors...

CVE-2008-3195

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. dot dot in the image variable, and execute arbitrary files via unspecified vectors...

CVE-2008-3195

Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. dot dot in the image variable, and execute arbitrary files via unspecified vectors...

CVE-2008-3195

CVE-2008-3195 affects TWiki prior to 4.2.3. The bin/configure script is vulnerable to directory traversal via the image parameter in installation steps, allowing read access to arbitrary files and potentially code execution. Public records (exploitdb, Debian security advisory DSA-1639-1, OpenVAS ...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. VID 9227dcaf-827f-11dd-9cd7-0050568452ac OpenVAS Vulnerability Test $ Description: Auto generated from VID 9227dcaf-827f-11dd-9cd7-0050568452ac Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD : twiki -- Arbitrary code execution in session files (9227dcaf-827f-11dd-9cd7-0050568452ac)

Th1nk3r reports : The version of TWiki installed on the remote host allows access to the 'configure' script and fails to sanitize the 'image' parameter of that script of directory traversal sequences before returning the file contents when the 'action' parameter is set to 'image'. An...

TWiki command execution vulnerability

Overview The TWiki wiki software fails to validate input passed to certain URLs. By accessing a URL containing the TWiki configuration script, an attacker may be able to read arbitrary files. Description TWiki is a wiki that is runs in the context of the Apache web server. TWiki is installed by...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. VID b4af3ede-36e9-11d9-a9e7-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. VID a876df84-0fef-11db-ac96-000c6ec775d9 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: twiki

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

TWiki bin/configure 'image' Parameter Traversal Arbitrary File Access/Execution

The version of TWiki running on the remote host allows access to the 'configure' script, and fails to sanitize the 'image' parameter of that script. When the 'action' parameter is set to 'image', an unauthenticated attacker can exploit this issue to execute arbitrary code or to view arbitrary fil...

TWiki 4.2.0 (configure) Remote File Disclosure Vulnerability

Exploit for cgi platform in category web applications ============================================================ TWiki 4.2.0 configure Remote File Disclosure Vulnerability ============================================================ TWiki 4.2.0 File Disclosure Vuln configure "We're brazilian...

twiki-disclose.txt

TWiki 4.2.0 File Disclosure Vuln configure "We're brazilian newbies!!! :p" - Th1nk3r Info ---------------------------------------------------------------------------------------------------------------- Classe : Input Validation Error Remote : Yes Local : No Date : 05/08/2008 Credits : Th1nk3r...

TWiki 4.2.0 - configure Remote File Disclosure

TWiki 4.2.0 - configure Remote File Disclosure TWiki 4.2.0 File Disclosure Vuln configure "We're brazilian newbies!!! :p" - Th1nk3r Info ---------------------------------------------------------------------------------------------------------------- Classe : Input Validation Error Remote : Yes...

TWiki 4.2.0 - 'configure' Remote File Disclosure

TWiki 4.2.0 File Disclosure Vuln configure "We're brazilian newbies!!! :p" - Th1nk3r Info ---------------------------------------------------------------------------------------------------------------- Classe : Input Validation Error Remote : Yes Local : No Date : 05/08/2008 Credits : Th1nk3r...

twiki -- Arbitrary code execution in session files

Th1nk3r reports: The version of TWiki installed on the remote host allows access to the 'configure' script and fails to sanitize the 'image' parameter of that script of directory traversal sequences before returning the file contents when the 'action' parameter is set to 'image'. An unauthenticat...

TWiki脚本文件上传漏洞

BUGTRAQ ID: 18854 CVECAN ID: CVE-2006-3336 TWiki是一款灵活易用、功能强大的企业协作平台。 TWiki对上传文件的后缀检查过滤不充分，远程攻击者可能利用此漏洞上传脚本文件执行，从而以Web进程权限在服务器上执行任意命令。 TWiki上传过滤器可以在上传的文件名后附加.txt后缀，以防执行.php、.php1、.phps、.pl之类的可执行脚本。但是，PHP和其他一些类型允许额外的文件后缀，如.php.en、.php.1和.php.2等。TWiki没有检查这些后缀，也就是可能没有添加.txt文件名后缀便上传一些PHP脚本，导致执行任意代码。 0...