[ MDVSA-2015:185 ] dokuwiki

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:185 http://www.mandriva.com/en/support/security/ Package : dokuwiki Date : March 31, 2015 Affected: Business Server 1.0 Problem Description: Updated dokuwiki packages fix security vulnerabilities:...

Fedora 20 : dokuwiki-0-0.24.20140929c.fc20 (2015-3211)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Fedora 21 : dokuwiki-0-0.24.20140929c.fc21 (2015-3186)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Fedora Update for dokuwiki FEDORA-2015-3186

The remote host is missing an update for the Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Updated docuwiki package fixes CVE-2014-9253

Updated dokuwiki package fix a security vulnerability: Our current dokuwiki-20140929-1.1.mga4 package uses dokuwiki-2014-09-29a source which allows swf application/x-shockwave-flash uploads by default. This may be used for Cross-site scripting XSS attack which enables attackers to inject...

CVE-2014-9253

The default file type whitelist configuration in conf/mime.conf in the Media Manager in DokuWiki before 2014-09-29b allows remote attackers to execute arbitrary web script or HTML by uploading an SWF file, then accessing it via the media parameter to lib/exe/fetch.php...

CVE-2014-9253

CVE-2014-9253 affects DokuWiki’s Media Manager when using the default SWF/upload whitelist in conf/mime.conf prior to the 2014-09-29b patch. An attacker can upload an SWF file and then access it via the media parameter to lib/exe/fetch.php, enabling remote execution of web scripts/HTML (XSS-like ...