DokuWiki doku.php file cross-site scripting vulnerability

DokuWiki is a German software developer Andreas Gohr developed a PHP-based Wiki engine , it is mainly used for small and medium-sized team and personal website knowledge base management , and provides version control , full-text search and permission control and other functions . A cross-site...

CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

CVE-2017-12583

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

PT-2017-12587

Name of the Vulnerable Software and Affected Versions DokuWiki versions prior to 2017-02-19b Description The issue concerns an XSS vulnerability in the at parameter, also known as the DATE AT variable, which is used in the "doku.php" endpoint. Recommendations For versions prior to 2017-02-19b,...

CVE-2017-12583: Improper Neutralization of Input During Web Page Generation

DokuWiki through 2017-02-19b has XSS in the at parameter aka the DATEAT variable to doku.php...

PT-2012-4660

Name of the Vulnerable Software and Affected Versions DokuWiki versions used in Fedora 16, 17, and 18 Description The issue allows remote attackers to obtain sensitive information via the prefix parameter in the "doku.php" file. This occurs when certain PHP error levels are set, resulting in the...

CVE-2012-3354: Exposure of Sensitive Information to an Unauthorized Actor

doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message...

DEBIAN-CVE-2012-2128

Cross-site request forgery CSRF vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129...

CVE-2012-2129

Cross-site scripting XSS vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action...

CVE-2012-2128

Cross-site request forgery CSRF vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129...

CVE-2012-2129: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action...

CVE-2012-2128: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129...

CVE-2009-1960

inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via the configcascademaindefault parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp://...

CVE-2006-4674

CVE-2006-4674 concerns DokuWiki prior to 2006-03-09c. A direct static code injection flaw in the script doku.php allows remote attackers to execute arbitrary PHP code by supplying a crafted X-FORWARDED-FOR HTTP header, which is stored in config.php. The vulnerability is characterized by an attack...

CVE-2006-4674: Undefined Security Weakness

Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c allows remote attackers to execute arbitrary PHP code via the X-FORWARDED-FOR HTTP header, which is stored in config.php...