CVE-2015-7816

CVE-2015-7816 affects Piwik (renamed Matomo) prior to 2.15.0, where the DisplayTopKeywords function in plugins/Referrers/Controller.php allows PHP object injection, Server-Side Request Forgery (SSRF), and arbitrary PHP code execution via a crafted HTTP header. The issue is caused by insecure hand...

CVE-2015-7815

The CVE-2015-7815 entry is supported by multiple connected documents describing a Directory Traversal (Local File Inclusion) in Piwik prior to 2.15.0. The vulnerability occurs in core/ViewDataTable/Factory.php where the viewDataTable parameter is used to include local files, due to insufficient s...

Piwik Analytics Detection

The script sends a HTTP request to the server and attempts to identify Piwik and its version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Piwik 2.14.3 PHP Object Injection

----------------------------------------------------------------------- Piwik = 2.14.3 DisplayTopKeywords PHP Object Injection Vulnerability ----------------------------------------------------------------------- - Software Link: https://piwik.org/ - Affected Versions: Version 2.14.3 and prior...

Piwik 2.14.3 PHP Object Injection Vulnerability

Piwik versions 2.14.3 and below suffer from a PHP object injection vulnerability that can lead to remote code execution. ----------------------------------------------------------------------- Piwik = 2.14.3 DisplayTopKeywords PHP Object Injection Vulnerability...

Piwik 2.14.3 Local File Inclusion

----------------------------------------------------------------------- Piwik = 2.14.3 viewDataTable Autoloaded File Inclusion Vulnerability ----------------------------------------------------------------------- - Software Link: https://piwik.org/ - Affected Versions: Version 2.14.3 and prior...

Piwik 2.14.3 Local File Inclusion Vulnerability

Piwik version 2.14.3 and below suffer from a local file inclusion vulnerability. ----------------------------------------------------------------------- Piwik = 2.14.3 viewDataTable Autoloaded File Inclusion Vulnerability ----------------------------------------------------------------------- -...

WordPress Piwik Plugin <= 1.0.4 - Cross-Site Scripting (XSS)

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

SA-CONTRIB-2014-120 - Piwik Web Analytics - Information disclosure

This module enables you to integrate Drupal with Piwik Web Analytics. The module leaks the site specific hash salt to authenticated users when user-id tracking is turned on. This vulnerability is mitigated by the fact that user-id tracking must be turned on and the attacker needs to have an accou...

CVE-2014-5871

The Piwik Mobile 2 aka org.piwik.mobile2 application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Piwik Mobile 2 aka org.piwik.mobile2 application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5871

The CVE-2014-5871 entry concerns Piwik Mobile 2 (org.piwik.mobile2) for Android, version 2.0.1. It states that the application does not verify X.509 certificates from SSL servers, allowing man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The...

CVE-2014-5871

The Piwik Mobile 2 aka org.piwik.mobile2 application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Piwik <= 0.5.5 'form_url' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/39144/info Piwik is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Piwik <= 1357 2009-08-02 file upload and code execution

No description provided by source...

Piwik Open Flash Chart Remote Code Execution Vulnerability

No description provided by source. Bugtraq ID: 37314 Class: Input Validation Error CVE: Remote: Yes Local: No Published: Dec 14 2009 12:00AM Updated: Dec 17 2009 06:03PM Credit: Braeden Thomas Vulnerable: Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.4 Piwik Piwik 0.2.37 Piw...

Piwik 0.4.5 /core/cookie.php 命令执行漏洞

No description provided by source...

VulnCheck KEV: CVE-2009-4140

Unrestricted file upload vulnerability in ofcuploadimage.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when registerglobals is enabled, allows remote authenticated users...

Open Flash Chart 2 Arbitrary File Upload Vulnerability

This Metasploit module exploits a file upload vulnerability found in Open Flash Chart version 2. Attackers can abuse the 'ofcuploadimage.php' file in order to upload and execute malicious PHP files. This module requires Metasploit: http//metasploit.com/download Current source:...

CVE-2013-2633

Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters...