TW
Product
Twiki
29
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 0Medium 1Low 0
Watch
Add Twiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-1751 | 9.8 | Nov 7 | TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick characters Affected: before 5.1.4 |
| CVE-2005-3056 | 9.8 | Nov 1 | TWiki allows arbitrary shell command execution via the Include function Affected: 20040902-3 |
| CVE-2014-7236 | 9.1 | Feb 17 | Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to… Affected: 4.0 through 4.0.5; 4.1 through 4.1.2; 4.2 through 4.2.4; 4.3 through 4.3.2; 5.0 through 5.0.2; 5.1.0 through 5.1.4; +1 more |
| CVE-2018-20212 | 6.1 | Mar 17 | bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter Affected: 6.0.2 |
| CVE-2014-9367 | – | Dec 31 | Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a… Affected: 6.0.0; 6.0.1 |
| CVE-2014-9325 | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variable in lib/TWiki.pm… Affected: 6.0.1 |
| CVE-2014-7237 | – | Oct 16 | lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via… Affected: through 6.0.0 |
| CVE-2012-6330 | – | Jan 4 | The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory… Affected: through 5.1.2; 5.1.0; 5.1.1 |
| CVE-2012-0979 | – | Feb 2 | Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1)… Affected: 5.1.1 |
| CVE-2011-3010 | – | Sep 30 | Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a… Affected: through 5.0.1; 4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +14 more |
| CVE-2011-1838 | – | May 20 | Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via the origurl… Affected: through 5.0.1; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +14 more |
| CVE-2010-3841 | – | Oct 18 | Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter… Affected: through 5.0.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +18 more |
| CVE-2009-4898 | – | Sep 7 | Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that update pages, as… Affected: through 4.3.1; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +10 more |
| CVE-2009-1339 | – | Apr 30 | Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update… Affected: through 4.3.0; 4.1.2; 4.2.0; 4.2.1; 4.2.2; 4.2.3; +1 more |
| CVE-2008-5305 | – | Dec 10 | Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable Affected: through 4.2.3; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +7 more |
| CVE-2008-5304 | – | Dec 10 | Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable Affected: through 4.2.3; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +15 more |
| CVE-2008-4998 | – | Nov 7 | postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file Affected: 4.1.2 |
| CVE-2008-3195 | – | Sep 18 | Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files… Affected: through 4.2.2; 4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +7 more |
| CVE-2007-5193 | – | Oct 4 | The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir}) under the web… Affected: 4.1.2 |
| CVE-2007-0669 | – | Feb 8 | Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +1 more |
| CVE-2006-6071 | – | Dec 2 | TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed… Affected: through 4.0.5 |
| CVE-2006-4294 | – | Sep 9 | Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4 |
| CVE-2006-3819 | – | Jul 27 | Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST request containing a… Affected: 4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4 |
| CVE-2006-3336 | – | Jul 5 | TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and… Affected: 4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 2000-12-01; +7 more |
| CVE-2006-2942 | – | Jun 20 | TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribute that references… Affected: 4.0.0; 4.0.1; 4.0.2 |
| CVE-2006-1387 | – | Mar 26 | TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to CPU and memory… Affected: 4.0; 4.0.1; 2001-09-01; 2001-12-01; 2003-02-01; 2004-09-01; +3 more |
| CVE-2006-1386 | – | Mar 26 | The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access restricted content… Affected: 4.0; 4.0.1 |
| CVE-2005-2877 | – | Sep 16 | The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev… Affected: 2000-12-01; 2001-12-01; 2003-02-01; 2004-09-01; 2004-09-02 |
| CVE-2004-1037 | – | Mar 1 | The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string Affected: 2003-02-01 |
Showing 29