Unscored severity · published Mar 26, 2006
CVE-2006-1386
The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content in TWiki topics.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twiki · Twiki
4.0; 4.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1386
secunia.com
http://secunia.com/advisories/19410
securitytracker.com
http://securitytracker.com/id?1015843
twiki.org
http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4RdiffPreviewAccess
www.securityfocus.com
http://www.securityfocus.com/bid/17268
www.vupen.com
http://www.vupen.com/english/advisories/2006/1116
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25444
More from Twiki
9.8
CVE-2013-1751
TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick characters
9.8
CVE-2005-3056
TWiki allows arbitrary shell command execution via the Include function
9.1
CVE-2014-7236
Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to…
6.1
CVE-2018-20212
bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter
–
CVE-2014-9367
Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a…