Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
MoinmoMoinmoin

26 matches found

CVE
CVE•added 2020/11/10 5:15 p.m.•158 views

CVE-2020-25074

The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.

9.8CVSS9.4AI score0.12807EPSS
CVE
CVE•added 2020/11/11 4:15 p.m.•138 views

CVE-2020-15275

MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade ...

8.7CVSS7.2AI score0.00297EPSS
CVE
CVE•added 2010/04/05 3:30 p.m.•91 views

CVE-2010-0828

Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote authenticated users to inject arbitrary web script or HTML by creating a page with a crafted URI.

3.5CVSS5AI score0.00619EPSS
CVE
CVE•added 2018/10/15 7:29 p.m.•91 views

CVE-2017-5934

Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6.1CVSS5.8AI score0.00691EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•90 views

CVE-2012-6081

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extensio...

6CVSS7.4AI score0.76114EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•77 views

CVE-2012-6082

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/init .py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

4.3CVSS5.7AI score0.00407EPSS
CVE
CVE•added 2017/01/30 10:59 p.m.•77 views

CVE-2016-9119

Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

6.1CVSS5.8AI score0.00762EPSS
CVE
CVE•added 2010/02/26 7:30 p.m.•67 views

CVE-2010-0717

The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

7.5CVSS6.3AI score0.00606EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•67 views

CVE-2012-6080

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

6.4CVSS6.7AI score0.01528EPSS
CVE
CVE•added 2011/02/22 6:0 p.m.•64 views

CVE-2011-1058

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: s...

2.6CVSS5.4AI score0.00844EPSS
CVE
CVE•added 2010/08/05 1:22 p.m.•63 views

CVE-2010-2487

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage...

4.3CVSS5.5AI score0.01315EPSS
CVE
CVE•added 2010/04/05 3:30 p.m.•60 views

CVE-2010-1238

MoinMoin 1.7.1 allows remote attackers to bypass the textcha protection mechanism by modifying the textcha-question and textcha-answer fields to have empty values.

5CVSS6.5AI score0.00246EPSS
CVE
CVE•added 2016/11/10 5:59 p.m.•60 views

CVE-2016-7148

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.

6.1CVSS5.9AI score0.00235EPSS
CVE
CVE•added 2012/09/10 10:55 p.m.•59 views

CVE-2012-4404

security/init .py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.

6CVSS6AI score0.0099EPSS
CVE
CVE•added 2016/11/10 5:59 p.m.•59 views

CVE-2016-7146

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.

6.1CVSS5.9AI score0.0025EPSS
CVE
CVE•added 2010/02/26 7:30 p.m.•58 views

CVE-2010-0669

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

7.5CVSS6.3AI score0.01448EPSS
CVE
CVE•added 2010/08/05 1:22 p.m.•58 views

CVE-2010-2969

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CV...

4.3CVSS5.7AI score0.01315EPSS
CVE
CVE•added 2013/01/03 1:55 a.m.•56 views

CVE-2012-6495

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be levera...

6CVSS7.2AI score0.76114EPSS
CVE
CVE•added 2010/02/26 7:30 p.m.•52 views

CVE-2010-0668

Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.

6.8CVSS6.2AI score0.01554EPSS
CVE
CVE•added 2010/08/05 1:22 p.m.•51 views

CVE-2010-2970

Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.

4.3CVSS5.7AI score0.01315EPSS
CVE
CVE•added 2009/03/30 1:30 a.m.•48 views

CVE-2008-6548

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

5CVSS6.3AI score0.00228EPSS
CVE
CVE•added 2009/04/29 6:30 p.m.•48 views

CVE-2009-1482

Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_for...

4.3CVSS5.4AI score0.03091EPSS
CVE
CVE•added 2010/02/26 7:30 p.m.•45 views

CVE-2010-0667

MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.

5CVSS6.1AI score0.00765EPSS
CVE
CVE•added 2010/03/29 8:30 p.m.•44 views

CVE-2009-4762

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.

7.5CVSS6.5AI score0.00759EPSS
CVE
CVE•added 2009/03/30 1:30 a.m.•43 views

CVE-2008-6549

The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.

5CVSS6.7AI score0.00543EPSS
CVE
CVE•added 2009/04/03 6:30 p.m.•38 views

CVE-2008-6603

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937.

6.8CVSS6.5AI score0.00903EPSS