CVE-2007-2613

WikkaWiki Wikka Wiki before 1.1.6.3 allows attackers in a shared virtual host server environment to upload and execute an arbitrary configuration file by modifying the WAKKACONFIG environment variable...

CVE-2007-2612

The CVE affects WikkaWiki (Wikka Wiki) where the libs/Wakka.class.php component is vulnerable to SQL injection. Versions prior to 1.1.6.3 allow remote attackers to execute arbitrary SQL commands via the limit parameter, with impact on confidentiality, integrity, and availability noted as Partial....

CVE-2007-2551

CVE-2007-2551 affects WikkaWiki (Wikka Wiki) prior to 1.1.6.3. The vulnerability is a Cross-Site Scripting (XSS) in usersettings.php that allows remote attackers to inject arbitrary web script or HTML via the name parameter. Impact is consistent with an XSS in the name field, enabling script exec...

[ECHO_ADV_78$2007] C-Arbre <= 0.6PR7 (root_path) Remote File Inclusion Vulnerability

ECHOADV78$2007 ----------------------------------------------------------------------------------------- ECHOADV78$2007 C-Arbre = 0.6PR7 rootpath Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran Addahro...

JVN#91706484 Trac cross-site scripting vulnerability

Impact A remote attacker could possibly execute an arbitrary script on the user's IE where the user views a Trac wiki content. Solution Products Affected trac 0.10.3 and earlier versions trac-0.10.3-ja-1 and earlier versions...

FreeBSD : trac -- XSS vulnerability (e546c7ce-ce46-11db-bc24-0016179b2dd5)

Secunia reports : The vulnerability is caused due to an error within the 'download wiki page as text' function, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Successful exploitation may require that the victim uses IE...

Cross site scripting

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

DEBIAN-CVE-2007-1405

Cross-site scripting XSS vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2006-7050

WikkaWiki (Wikka Wiki) prior to 1.1.6.2 contains a Cross‑site Scripting (XSS) vulnerability. The issue allows remote attackers to inject arbitrary JavaScript through (1) events in forced links (url parameter) not properly sanitized in formatters/wakka.php and possibly (2) other vectors in wikka.p...

CVE-2006-7049

CVE-2006-7049 affects WikkaWiki prior to 1.1.6.2. The Method() in wikka.php calls strstr and strrpos with arguments in the wrong order, which can bypass access restrictions and allow remote attackers to access arbitrary PHP files. Public references also describe it as a local file inclusion vulne...

[Full-disclosure] CVSTrac 2.0.0 Denial of Service (DoS) vulnerability

SECURITY ADVISORY ================= Application: CVSTrac Version: 2.0.0 Vulnerability: Denial of Service DoS Identification: CVE-2007-0347 Date: 2007-01-29 12:00 UTC DESCRIPTION ----------- A Denial of Service DoS vulnerability exists in CVSTrac http://www.cvstrac.org/ version 2.0.0, a web-based...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

Cross site scripting

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2007-0308

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.3.4 beta allows remote attackers to inject arbitrary web script or HTML via Wiki Page titles...

CVE-2006-6925

Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...

CVE-2006-6924

bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sortmode=-98 query string to 1 blogs/listblogs.php, 2 fisheye/index.php, 3 wiki/orphanpages.php, or 4 wiki/listpages.php, which forces a SQL error. NOTE: the fisheye/listgalleries.php vector is already cover...

CVE-2006-6925

Multiple cross-site scripting XSS vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the message title field when submitting an article to articles/edit.php, 2 the message title field when submitting a blog post to blogs/post.php, or...

CVE-2006-6889

CVE-2006-6889 affects FreeStyle Wiki (fswiki) 3.6.2 and earlier. The issue is that sensitive information (including passwords) is stored under the web root with insufficient access control, allowing remote attackers to obtain passwords by directly requesting config/user.dat. The provided document...

CVE-2006-6889

FreeStyle Wiki fswiki 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request for config/user.dat...

CVE-2006-6889

FreeStyle Wiki fswiki 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain passwords via a direct request for config/user.dat...