338 matches found
CVE-2007-5193
The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...
Default configuration
The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...
CVE-2007-5193
The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...
CVE-2007-5193
The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...
CVE-2007-5193
Twiki 4.1.2 on Debian GNU/Linux (and possibly other OS) has a default configuration that places the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root. This may allow remote attackers to obtain sensitive information if .htaccess restrictions are not applied. Public details co...
Design/Logic Flaw
Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...
CVE-2007-0669
Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...
CVE-2007-0669
Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...
CVE-2007-0669
Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files...
CVE-2007-0669
CVE-2007-0669: Concrete details from the connected CERT/NVD entry show that TWiki 4.0.0–4.1.0 is affected by an arbitrary code execution vulnerability through CGI session files in the /tmp directory. An attacker who can create CGI session files may execute Perl code with the web server’s privileg...
TWiki vulnerable to arbitrary code execution via CGI session files
Overview TWiki fails to protect the CGI session directory, which may allow an attacker to execute arbitrary code with the privileges of the web server. Description TWiki is a web-based collaborative publishing environment. TWiki creates CGI session files in the global /tmp directory, which is...
TWiki Viewfile目录遍历漏洞
TWiki是一款流行的基于WEB的百科全书程序 TWiki不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题是由于'TWikiDocGraphics'脚本对用户提交给'filename'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制以WEB进程权限查看系统文件内容。 0 TWiki TWiki 04x00x03 TWiki TWiki 04x00x04 TWiki TWiki 04x00x02 TWiki TWiki 04x00x01 TWiki TWiki 04x00x00 可参考如下补丁程序： a...
TWiki失败登录信息泄露漏洞
TWiki是一款流行的基于WEB的百科全书程序。 TWiki处理失败登录存在问题，远程攻击者可以利用漏洞访问受限制的标题。 当站点设置为如下： 1，如果ErrorDocument 401设置指向TWikiRegistration标题或者任意TWiki标题并且 2，使用TWiki-4.0的ApacheLogin和会话起用，或者使用SessionPlugin的早期TWiki版本，并且 3，运行了Apache 1.3。 那么可使用如下方法进行测试： 1，在左边栏点'Login'连接 2，输入合法用户名，但错误的密码 3，点"ok" 4，如果Apache重提示，再输入相同用户名和密码...
TWiki <= 4.0.4 (configure) Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl Tue Aug 1 13:18:12 CEST 2006 [email protected] use strict; use LWP::UserAgent; use LWP::Simple; use HTTP::Request; use HTTP::Response; use Getopt::Long; $| = 1; couse 1 is bigger than 0 my $proxy,$proxyuser,$proxypass; my $host,$debug,$dir,...
CVE-2006-6071
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with...
CVE-2006-6071
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with...
CVE-2006-6071
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with...
CVE-2006-6071
The vulnerability CVE-2006-6071 affects TWiki 4.0.5 and earlier when run under Apache 1.3 with ApacheLogin, sessions, and ErrorDocument 401 redirects to a valid wiki topic. The root cause is improper handling of failed login attempts, allowing remote attackers to read arbitrary content by cancell...
TWiki 'filename' Parameter Traversal Arbitrary File Access
The version of TWiki running on the remote host allows directory traversal sequences in the 'filename' parameter in the viewfile function of 'lib/TWiki/UI/View.pm'. An unauthenticated attacker can exploit this issue to view arbitrary files on the remote host subject to the privileges of the web...