17 matches found
CVE-2012-5321
tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."...
PT-2012-5920
Name of the Vulnerable Software and Affected Versions TikiWiki CMS/Groupware version 8.3 Description The issue allows remote attackers to load arbitrary web site pages into frames, which can be used to conduct phishing attacks. This is achieved via the url parameter in the tiki-featured link.php...
CVE-2012-5321: Improper Input Validation
tiki-featuredlink.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishing attacks via the url parameter, aka "frame injection."...
CVE-2011-4551: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters...
PT-2012-1912
Name of the Vulnerable Software and Affected Versions TikiWiki CMS/Groupware versions prior to 8.2 TikiWiki CMS/Groupware LTS versions prior to 6.5 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via arbitrary parameters in the...
CVE-2012-0911: Deserialization of Untrusted Data
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the 1 cookieName to lib/banners/bannerlib.php; 2 printpages or 3 printstructures parameter to a tiki-printmultipages.php or b tiki-printpages.php; or 4...
CVE-2012-3996: Exposure of Sensitive Information to an Unauthorized Actor
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to 1 admin/includecalendar.php, 2 tiki-rsserror.php, or 3 tiki-watershedservice.php...
PT-2012-5124
Name of the Vulnerable Software and Affected Versions TikiWiki CMS/Groupware versions 8.3 and earlier Description The issue allows remote attackers to obtain the installation path via a direct request to API endpoints such as "admin/include calendar.php", "tiki-rss error.php", or "tiki-watershed...
CVE-2010-1133
Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to 1 tiki-searchindex.php and 2 tiki-searchresults.php...
CVE-2010-1135
The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...
CVE-2010-1133: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to 1 tiki-searchindex.php and 2 tiki-searchresults.php...
CVE-2010-1136: Undefined Security Weakness
The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php...
CVE-2010-1134: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the $searchDate variable...
CVE-2010-1135: Undefined Security Weakness
The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...
CVE-2008-3653
Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors...
CVE-2008-3654: Undefined Security Weakness
Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors...