Vulnerabilites related to matomo - matomo
CVE-2011-0398 (GCVE-0-2011-0398)
Vulnerability from cvelistv5
Published
2011-01-10 19:18
Modified
2024-08-06 21:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/45787 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/70384 | vdb-entry, x_refsource_OSVDB | |
| http://dev.piwik.org/trac/ticket/567 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/64641 | vdb-entry, x_refsource_XF | |
| http://piwik.org/blog/2011/01/piwik-1-1-2/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:08.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70384",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70384"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/567"
},
{
"name": "piwik-piwikcommongetip-security-bypass(64641)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64641"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70384",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70384"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/567"
},
{
"name": "piwik-piwikcommongetip-security-bypass(64641)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64641"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0398",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70384",
"refsource": "OSVDB",
"url": "http://osvdb.org/70384"
},
{
"name": "http://dev.piwik.org/trac/ticket/567",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/567"
},
{
"name": "piwik-piwikcommongetip-security-bypass(64641)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64641"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-2/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0398",
"datePublished": "2011-01-10T19:18:00",
"dateReserved": "2011-01-10T00:00:00",
"dateUpdated": "2024-08-06T21:51:08.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-4541 (GCVE-0-2012-4541)
Vulnerability from cvelistv5
Published
2012-11-19 11:00
Modified
2024-09-17 00:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://piwik.org/blog/2012/10/piwik-1-9/ | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/10/22/1 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2012/10/23/2 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:42:55.144Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2012/10/piwik-1-9/"
},
{
"name": "[oss-security] 20121022 Re: CVE request: XSS in piwik before 1.9",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/10/22/1"
},
{
"name": "[oss-security] 20121023 Re: CVE request: XSS in piwik before 1.9",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/10/23/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-11-19T11:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2012/10/piwik-1-9/"
},
{
"name": "[oss-security] 20121022 Re: CVE request: XSS in piwik before 1.9",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/10/22/1"
},
{
"name": "[oss-security] 20121023 Re: CVE request: XSS in piwik before 1.9",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/10/23/2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-4541",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://piwik.org/blog/2012/10/piwik-1-9/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2012/10/piwik-1-9/"
},
{
"name": "[oss-security] 20121022 Re: CVE request: XSS in piwik before 1.9",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/10/22/1"
},
{
"name": "[oss-security] 20121023 Re: CVE request: XSS in piwik before 1.9",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/10/23/2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-4541",
"datePublished": "2012-11-19T11:00:00Z",
"dateReserved": "2012-08-21T00:00:00Z",
"dateUpdated": "2024-09-17T00:36:04.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-1085 (GCVE-0-2009-1085)
Vulnerability from cvelistv5
Published
2009-03-25 18:00
Modified
2024-09-17 03:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2009/03/23/2 | mailing-list, x_refsource_MLIST | |
| http://dev.piwik.org/trac/ticket/599 | x_refsource_CONFIRM | |
| http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:57:17.812Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20090323 CVE request: API key disclosure in piwik",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/03/23/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/599"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-03-25T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20090323 CVE request: API key disclosure in piwik",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/03/23/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/599"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1085",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20090323 CVE request: API key disclosure in piwik",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/03/23/2"
},
{
"name": "http://dev.piwik.org/trac/ticket/599",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/599"
},
{
"name": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html",
"refsource": "MISC",
"url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1085",
"datePublished": "2009-03-25T18:00:00Z",
"dateReserved": "2009-03-25T00:00:00Z",
"dateUpdated": "2024-09-17T03:08:04.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7816 (GCVE-0-2015-7816)
Vulnerability from cvelistv5
Published
2015-11-16 19:00
Modified
2024-08-06 07:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header.
References
| ▼ | URL | Tags |
|---|---|---|
| http://karmainsecurity.com/KIS-2015-10 | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2015/Nov/15 | mailing-list, x_refsource_FULLDISC | |
| http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html | x_refsource_MISC | |
| https://piwik.org/changelog/piwik-2-15-0/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/archive/1/536839/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:59:00.479Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://karmainsecurity.com/KIS-2015-10"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/15"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/536839/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://karmainsecurity.com/KIS-2015-10"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/15"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/536839/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7816",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://karmainsecurity.com/KIS-2015-10",
"refsource": "MISC",
"url": "http://karmainsecurity.com/KIS-2015-10"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Nov/15"
},
{
"name": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html"
},
{
"name": "https://piwik.org/changelog/piwik-2-15-0/",
"refsource": "CONFIRM",
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-10] Piwik \u003c= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/536839/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7816",
"datePublished": "2015-11-16T19:00:00",
"dateReserved": "2015-10-14T00:00:00",
"dateUpdated": "2024-08-06T07:59:00.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-12215 (GCVE-0-2019-12215)
Vulnerability from cvelistv5
Published
2019-05-20 15:47
Modified
2024-08-04 23:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/matomo-org/matomo/issues/14464 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:17:38.910Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/matomo-org/matomo/issues/14464"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating \"avoid reporting path disclosures, as we don\u0027t consider them as security vulnerabilities."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-20T15:47:34",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/matomo-org/matomo/issues/14464"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-12215",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating \"avoid reporting path disclosures, as we don\u0027t consider them as security vulnerabilities.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/matomo-org/matomo/issues/14464",
"refsource": "MISC",
"url": "https://github.com/matomo-org/matomo/issues/14464"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-12215",
"datePublished": "2019-05-20T15:47:34",
"dateReserved": "2019-05-20T00:00:00",
"dateUpdated": "2024-08-04T23:17:38.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-4140 (GCVE-0-2009-4140)
Vulnerability from cvelistv5
Published
2009-12-22 22:00
Modified
2024-08-07 06:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:09.663Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "37314",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37314"
},
{
"name": "59051",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/59051"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt"
},
{
"name": "[oss-security] 20091214 Re: CVE Request - Open Flash Chart v2",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/3"
},
{
"name": "[oss-security] 20091214 CVE Request - Open Flash Chart v2",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/1"
},
{
"name": "piwik-ofcuploadimage-code-execution(53825)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53825"
},
{
"name": "55160",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/55160"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://wordpress.org/extend/plugins/woopra/changelog/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt"
},
{
"name": "37078",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37078"
},
{
"name": "24969",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/24969"
},
{
"name": "55162",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/55162"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/"
},
{
"name": "ADV-2009-2966",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/2966"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt"
},
{
"name": "37911",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37911"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "37314",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37314"
},
{
"name": "59051",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/59051"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt"
},
{
"name": "[oss-security] 20091214 Re: CVE Request - Open Flash Chart v2",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/3"
},
{
"name": "[oss-security] 20091214 CVE Request - Open Flash Chart v2",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/1"
},
{
"name": "piwik-ofcuploadimage-code-execution(53825)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53825"
},
{
"name": "55160",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/55160"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://wordpress.org/extend/plugins/woopra/changelog/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt"
},
{
"name": "37078",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37078"
},
{
"name": "24969",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/24969"
},
{
"name": "55162",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/55162"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/"
},
{
"name": "ADV-2009-2966",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/2966"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt"
},
{
"name": "37911",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37911"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-4140",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "37314",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37314"
},
{
"name": "59051",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/59051"
},
{
"name": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt"
},
{
"name": "[oss-security] 20091214 Re: CVE Request - Open Flash Chart v2",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/3"
},
{
"name": "[oss-security] 20091214 CVE Request - Open Flash Chart v2",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/1"
},
{
"name": "piwik-ofcuploadimage-code-execution(53825)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53825"
},
{
"name": "55160",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/55160"
},
{
"name": "http://wordpress.org/extend/plugins/woopra/changelog/",
"refsource": "CONFIRM",
"url": "http://wordpress.org/extend/plugins/woopra/changelog/"
},
{
"name": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt"
},
{
"name": "37078",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37078"
},
{
"name": "24969",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/24969"
},
{
"name": "55162",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/55162"
},
{
"name": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/"
},
{
"name": "ADV-2009-2966",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/2966"
},
{
"name": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt"
},
{
"name": "37911",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37911"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-4140",
"datePublished": "2009-12-22T22:00:00",
"dateReserved": "2009-12-01T00:00:00",
"dateUpdated": "2024-08-07T06:54:09.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4941 (GCVE-0-2011-4941)
Vulnerability from cvelistv5
Published
2012-09-18 18:00
Modified
2024-09-16 19:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/ | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2012/03/19/8 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2012/03/18/1 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:23:39.701Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/"
},
{
"name": "[oss-security] 20120319 Re: CVE request: piwik before 1.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/19/8"
},
{
"name": "[oss-security] 20120318 Re: CVE request: piwik before 1.6",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/18/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-09-18T18:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/"
},
{
"name": "[oss-security] 20120319 Re: CVE request: piwik before 1.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/19/8"
},
{
"name": "[oss-security] 20120318 Re: CVE request: piwik before 1.6",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/03/18/1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-4941",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/"
},
{
"name": "[oss-security] 20120319 Re: CVE request: piwik before 1.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/03/19/8"
},
{
"name": "[oss-security] 20120318 Re: CVE request: piwik before 1.6",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/03/18/1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-4941",
"datePublished": "2012-09-18T18:00:00Z",
"dateReserved": "2011-12-23T00:00:00Z",
"dateUpdated": "2024-09-16T19:15:49.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3791 (GCVE-0-2011-3791)
Vulnerability from cvelistv5
Published
2011-09-24 00:00
Modified
2024-09-16 20:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2011/06/27/6 | mailing-list, x_refsource_MLIST | |
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1 | x_refsource_MISC | |
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:46:03.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-09-24T00:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3791",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1"
},
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3791",
"datePublished": "2011-09-24T00:00:00Z",
"dateReserved": "2011-09-23T00:00:00Z",
"dateUpdated": "2024-09-16T20:41:54.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-0194 (GCVE-0-2013-0194)
Vulnerability from cvelistv5
Published
2019-11-20 14:30
Modified
2024-08-06 14:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross-Site Scripting
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/01/17/15 | x_refsource_MISC | |
| https://security-tracker.debian.org/tracker/CVE-2013-0194 | x_refsource_MISC | |
| https://matomo.org/changelog/piwik-1-10/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:18:09.458Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0194"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "piwik",
"vendor": "piwik",
"versions": [
{
"status": "affected",
"version": "1.10.1"
}
]
}
],
"datePublic": "2013-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T14:30:12",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0194"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-0194",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "piwik",
"version": {
"version_data": [
{
"version_value": "1.10.1"
}
]
}
}
]
},
"vendor_name": "piwik"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.openwall.com/lists/oss-security/2013/01/17/15",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"name": "https://security-tracker.debian.org/tracker/CVE-2013-0194",
"refsource": "MISC",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0194"
},
{
"name": "https://matomo.org/changelog/piwik-1-10/",
"refsource": "CONFIRM",
"url": "https://matomo.org/changelog/piwik-1-10/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-0194",
"datePublished": "2019-11-20T14:30:12",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T14:18:09.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-0400 (GCVE-0-2011-0400)
Vulnerability from cvelistv5
Published
2011-01-10 19:18
Modified
2024-08-06 21:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/45787 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/70382 | vdb-entry, x_refsource_OSVDB | |
| http://dev.piwik.org/trac/ticket/1795 | x_refsource_CONFIRM | |
| http://piwik.org/blog/2011/01/piwik-1-1-2/ | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/64639 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:08.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70382",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/1795"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-cookie-weak-security(64639)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64639"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70382",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/1795"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-cookie-weak-security(64639)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64639"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0400",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "70382",
"refsource": "OSVDB",
"url": "http://osvdb.org/70382"
},
{
"name": "http://dev.piwik.org/trac/ticket/1795",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/1795"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-2/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-cookie-weak-security(64639)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64639"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0400",
"datePublished": "2011-01-10T19:18:00",
"dateReserved": "2011-01-10T00:00:00",
"dateUpdated": "2024-08-06T21:51:08.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-7815 (GCVE-0-2015-7815)
Vulnerability from cvelistv5
Published
2015-11-16 19:00
Modified
2024-08-06 07:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html | x_refsource_MISC | |
| https://piwik.org/changelog/piwik-2-15-0/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/archive/1/536838/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://karmainsecurity.com/KIS-2015-09 | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2015/Nov/14 | mailing-list, x_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:59:00.585Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/536838/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://karmainsecurity.com/KIS-2015-09"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-11-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/536838/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://karmainsecurity.com/KIS-2015-09"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/14"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7815",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html"
},
{
"name": "https://piwik.org/changelog/piwik-2-15-0/",
"refsource": "CONFIRM",
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/536838/100/0/threaded"
},
{
"name": "http://karmainsecurity.com/KIS-2015-09",
"refsource": "MISC",
"url": "http://karmainsecurity.com/KIS-2015-09"
},
{
"name": "20151104 [KIS-2015-09] Piwik \u003c= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/Nov/14"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7815",
"datePublished": "2015-11-16T19:00:00",
"dateReserved": "2015-10-14T00:00:00",
"dateUpdated": "2024-08-06T07:59:00.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-4137 (GCVE-0-2009-4137)
Vulnerability from cvelistv5
Published
2009-12-24 16:00
Modified
2024-09-16 20:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2009/12/14/2 | mailing-list, x_refsource_MLIST | |
| http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/ | x_refsource_CONFIRM | |
| http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf | x_refsource_MISC | |
| http://www.openwall.com/lists/oss-security/2009/12/10/1 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2009/12/09/2 | mailing-list, x_refsource_MLIST | |
| http://dev.piwik.org/trac/changeset/1637 | x_refsource_CONFIRM | |
| http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/ | x_refsource_MISC | |
| http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:54:09.863Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20091214 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf"
},
{
"name": "[oss-security] 20091210 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/10/1"
},
{
"name": "[oss-security] 20091209 Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/09/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/changeset/1637"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-12-24T16:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20091214 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf"
},
{
"name": "[oss-security] 20091210 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/10/1"
},
{
"name": "[oss-security] 20091209 Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/12/09/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/changeset/1637"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2009-4137",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20091214 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/2"
},
{
"name": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/"
},
{
"name": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf",
"refsource": "MISC",
"url": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf"
},
{
"name": "[oss-security] 20091210 Re: Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/12/10/1"
},
{
"name": "[oss-security] 20091209 Piwik \u003c= 0.4.5 Cookie Unserialize() Vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/12/09/2"
},
{
"name": "http://dev.piwik.org/trac/changeset/1637",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/changeset/1637"
},
{
"name": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/",
"refsource": "MISC",
"url": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"name": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/",
"refsource": "MISC",
"url": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2009-4137",
"datePublished": "2009-12-24T16:00:00Z",
"dateReserved": "2009-12-01T00:00:00Z",
"dateUpdated": "2024-09-16T20:27:20.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1844 (GCVE-0-2013-1844)
Vulnerability from cvelistv5
Published
2013-03-21 21:00
Modified
2024-09-17 01:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/03/12/4 | mailing-list, x_refsource_MLIST | |
| http://piwik.org/blog/2013/03/piwik-1-11/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:13:33.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20130311 Re: CVE request: XSS in piwik 1.11",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/03/12/4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-03-21T21:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20130311 Re: CVE request: XSS in piwik 1.11",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/03/12/4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-1844",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20130311 Re: CVE request: XSS in piwik 1.11",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/03/12/4"
},
{
"name": "http://piwik.org/blog/2013/03/piwik-1-11/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-1844",
"datePublished": "2013-03-21T21:00:00Z",
"dateReserved": "2013-02-19T00:00:00Z",
"dateUpdated": "2024-09-17T01:51:34.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-2633 (GCVE-0-2013-2633)
Vulnerability from cvelistv5
Published
2013-03-21 21:00
Modified
2024-09-16 17:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://piwik.org/blog/2013/03/piwik-1-11/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:44:32.649Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-03-21T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-2633",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://piwik.org/blog/2013/03/piwik-1-11/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-2633",
"datePublished": "2013-03-21T21:00:00Z",
"dateReserved": "2013-03-21T00:00:00Z",
"dateUpdated": "2024-09-16T17:53:59.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-0004 (GCVE-0-2011-0004)
Vulnerability from cvelistv5
Published
2011-01-10 19:18
Modified
2024-08-06 21:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://openwall.com/lists/oss-security/2011/01/06/1 | mailing-list, x_refsource_MLIST | |
| http://openwall.com/lists/oss-security/2011/01/06/15 | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/45659 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2011/0013 | vdb-entry, x_refsource_VUPEN | |
| http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/ | x_refsource_CONFIRM | |
| http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/ | x_refsource_CONFIRM | |
| http://piwik.org/blog/2011/01/piwik-1-1-2/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/42809 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/70310 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:02.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110105 CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/1"
},
{
"name": "[oss-security] 20110106 Re: CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/15"
},
{
"name": "45659",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45659"
},
{
"name": "ADV-2011-0013",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0013"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "42809",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42809"
},
{
"name": "70310",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-01-19T10:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20110105 CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/1"
},
{
"name": "[oss-security] 20110106 Re: CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/15"
},
{
"name": "45659",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45659"
},
{
"name": "ADV-2011-0013",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0013"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "42809",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42809"
},
{
"name": "70310",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-0004",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110105 CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/01/06/1"
},
{
"name": "[oss-security] 20110106 Re: CVE Request: Multiple XSS Vulnerabiliies \u003c Piwik 1.1",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/01/06/15"
},
{
"name": "45659",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45659"
},
{
"name": "ADV-2011-0013",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0013"
},
{
"name": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-2/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "42809",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42809"
},
{
"name": "70310",
"refsource": "OSVDB",
"url": "http://osvdb.org/70310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-0004",
"datePublished": "2011-01-10T19:18:00",
"dateReserved": "2010-12-07T00:00:00",
"dateUpdated": "2024-08-06T21:36:02.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6923 (GCVE-0-2023-6923)
Vulnerability from cvelistv5
Published
2024-02-20 18:56
Modified
2024-08-02 08:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| matomoteam | Matomo Analytics – Ethical Stats. Powerful Insights. |
Version: * ≤ 4.15.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-29T18:21:23.477955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:15.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:42:08.402Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3031495%40matomo\u0026new=3031495%40matomo\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Matomo Analytics \u2013 Ethical Stats. Powerful Insights.",
"vendor": "matomoteam",
"versions": [
{
"lessThanOrEqual": "4.15.3",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Felipe Restrepo Rodriguez"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Matomo Analytics \u2013 Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-20T18:56:24.446Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3031495%40matomo\u0026new=3031495%40matomo\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2024-02-07T00:00:00.000+00:00",
"value": "Disclosed"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-6923",
"datePublished": "2024-02-20T18:56:24.446Z",
"dateReserved": "2023-12-18T15:12:38.158Z",
"dateUpdated": "2024-08-02T08:42:08.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-0399 (GCVE-0-2011-0399)
Vulnerability from cvelistv5
Published
2011-01-10 19:18
Modified
2024-08-06 21:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/45787 | vdb-entry, x_refsource_BID | |
| http://dev.piwik.org/trac/ticket/1679 | x_refsource_CONFIRM | |
| http://piwik.org/blog/2011/01/piwik-1-1-2/ | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/64640 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/70383 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:09.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/1679"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-loginform-clickjacking(64640)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64640"
},
{
"name": "70383",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70383"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/1679"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-loginform-clickjacking(64640)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64640"
},
{
"name": "70383",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70383"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0399",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "http://dev.piwik.org/trac/ticket/1679",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/1679"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-2/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-loginform-clickjacking(64640)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64640"
},
{
"name": "70383",
"refsource": "OSVDB",
"url": "http://osvdb.org/70383"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0399",
"datePublished": "2011-01-10T19:18:00",
"dateReserved": "2011-01-10T00:00:00",
"dateUpdated": "2024-08-06T21:51:09.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2786 (GCVE-0-2010-2786)
Vulnerability from cvelistv5
Published
2010-08-02 21:00
Modified
2024-08-07 02:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/ | x_refsource_CONFIRM | |
| http://piwik.org/changelog/ | x_refsource_CONFIRM | |
| http://marc.info/?l=oss-security&m=128041221832498&w=2 | mailing-list, x_refsource_MLIST | |
| http://www.osvdb.org/66759 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2010/1971 | vdb-entry, x_refsource_VUPEN | |
| http://marc.info/?l=oss-security&m=128032989120346&w=2 | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/42031 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/60808 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/40703 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:46:48.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/changelog/"
},
{
"name": "[oss-security] 20100729 Re: CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=128041221832498\u0026w=2"
},
{
"name": "66759",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/66759"
},
{
"name": "ADV-2010-1971",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1971"
},
{
"name": "[oss-security] 20100728 CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=128032989120346\u0026w=2"
},
{
"name": "42031",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/42031"
},
{
"name": "piwik-data-renderer-file-include(60808)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60808"
},
{
"name": "40703",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40703"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-07-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/changelog/"
},
{
"name": "[oss-security] 20100729 Re: CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=128041221832498\u0026w=2"
},
{
"name": "66759",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/66759"
},
{
"name": "ADV-2010-1971",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1971"
},
{
"name": "[oss-security] 20100728 CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=128032989120346\u0026w=2"
},
{
"name": "42031",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/42031"
},
{
"name": "piwik-data-renderer-file-include(60808)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60808"
},
{
"name": "40703",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40703"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-2786",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/"
},
{
"name": "http://piwik.org/changelog/",
"refsource": "CONFIRM",
"url": "http://piwik.org/changelog/"
},
{
"name": "[oss-security] 20100729 Re: CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=128041221832498\u0026w=2"
},
{
"name": "66759",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/66759"
},
{
"name": "ADV-2010-1971",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1971"
},
{
"name": "[oss-security] 20100728 CVE Request: Piwik \u003c 0.6.4 Arbitrary file inclusion",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=128032989120346\u0026w=2"
},
{
"name": "42031",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/42031"
},
{
"name": "piwik-data-renderer-file-include(60808)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60808"
},
{
"name": "40703",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40703"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2786",
"datePublished": "2010-08-02T21:00:00",
"dateReserved": "2010-07-22T00:00:00",
"dateUpdated": "2024-08-07T02:46:48.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-1453 (GCVE-0-2010-1453)
Vulnerability from cvelistv5
Published
2010-05-07 17:43
Modified
2024-09-16 18:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/ | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2010/05/05/3 | mailing-list, x_refsource_MLIST | |
| http://www.vupen.com/english/advisories/2010/1079 | vdb-entry, x_refsource_VUPEN | |
| http://www.openwall.com/lists/oss-security/2010/05/05/4 | mailing-list, x_refsource_MLIST | |
| http://secunia.com/advisories/39666 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:21:19.049Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/"
},
{
"name": "[oss-security] 20100505 CVE Request - Piwik 0.5.5 - XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/3"
},
{
"name": "ADV-2010-1079",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1079"
},
{
"name": "[oss-security] 20100505 Re: CVE Request - Piwik 0.5.5 - XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/4"
},
{
"name": "39666",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/39666"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-05-07T17:43:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/"
},
{
"name": "[oss-security] 20100505 CVE Request - Piwik 0.5.5 - XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/3"
},
{
"name": "ADV-2010-1079",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1079"
},
{
"name": "[oss-security] 20100505 Re: CVE Request - Piwik 0.5.5 - XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/4"
},
{
"name": "39666",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/39666"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-1453",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/"
},
{
"name": "[oss-security] 20100505 CVE Request - Piwik 0.5.5 - XSS vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/3"
},
{
"name": "ADV-2010-1079",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1079"
},
{
"name": "[oss-security] 20100505 Re: CVE Request - Piwik 0.5.5 - XSS vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/4"
},
{
"name": "39666",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/39666"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-1453",
"datePublished": "2010-05-07T17:43:00Z",
"dateReserved": "2010-04-15T00:00:00Z",
"dateUpdated": "2024-09-16T18:44:21.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-0195 (GCVE-0-2013-0195)
Vulnerability from cvelistv5
Published
2019-11-20 14:31
Modified
2024-08-06 14:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross-Site Scripting
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/01/17/15 | x_refsource_MISC | |
| https://security-tracker.debian.org/tracker/CVE-2013-0195 | x_refsource_MISC | |
| https://matomo.org/changelog/piwik-1-10/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:18:09.555Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0195"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "piwik",
"vendor": "piwik",
"versions": [
{
"status": "affected",
"version": "through 2013"
}
]
}
],
"datePublic": "2013-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T14:31:59",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0195"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-0195",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "piwik",
"version": {
"version_data": [
{
"version_value": "through 2013"
}
]
}
}
]
},
"vendor_name": "piwik"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.openwall.com/lists/oss-security/2013/01/17/15",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"name": "https://security-tracker.debian.org/tracker/CVE-2013-0195",
"refsource": "MISC",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0195"
},
{
"name": "https://matomo.org/changelog/piwik-1-10/",
"refsource": "CONFIRM",
"url": "https://matomo.org/changelog/piwik-1-10/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-0195",
"datePublished": "2019-11-20T14:31:59",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T14:18:09.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-0193 (GCVE-0-2013-0193)
Vulnerability from cvelistv5
Published
2019-11-20 14:26
Modified
2024-08-06 14:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross-Site Scripting
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security-tracker.debian.org/tracker/CVE-2013-0193 | x_refsource_MISC | |
| http://www.openwall.com/lists/oss-security/2013/01/17/15 | x_refsource_MISC | |
| https://matomo.org/changelog/piwik-1-10/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:18:09.554Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0193"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "piwik",
"vendor": "piwik",
"versions": [
{
"status": "affected",
"version": "1.10.1"
}
]
}
],
"datePublic": "2013-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-20T14:26:54",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0193"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-0193",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "piwik",
"version": {
"version_data": [
{
"version_value": "1.10.1"
}
]
}
}
]
},
"vendor_name": "piwik"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://security-tracker.debian.org/tracker/CVE-2013-0193",
"refsource": "MISC",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0193"
},
{
"name": "http://www.openwall.com/lists/oss-security/2013/01/17/15",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"name": "https://matomo.org/changelog/piwik-1-10/",
"refsource": "CONFIRM",
"url": "https://matomo.org/changelog/piwik-1-10/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-0193",
"datePublished": "2019-11-20T14:26:54",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T14:18:09.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-0401 (GCVE-0-2011-0401)
Vulnerability from cvelistv5
Published
2011-01-10 19:18
Modified
2024-08-06 21:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/45787 | vdb-entry, x_refsource_BID | |
| http://dev.piwik.org/trac/ticket/1910 | x_refsource_CONFIRM | |
| http://dev.piwik.org/trac/ticket/1279#comment:13 | x_refsource_CONFIRM | |
| http://piwik.org/blog/2011/01/piwik-1-1-2/ | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/64638 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/70381 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:51:08.771Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/1910"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.piwik.org/trac/ticket/1279#comment:13"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-sessions-dos(64638)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64638"
},
{
"name": "70381",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/70381"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-01-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45787",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45787"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/1910"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.piwik.org/trac/ticket/1279#comment:13"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-sessions-dos(64638)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64638"
},
{
"name": "70381",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/70381"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0401",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45787",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"name": "http://dev.piwik.org/trac/ticket/1910",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/1910"
},
{
"name": "http://dev.piwik.org/trac/ticket/1279#comment:13",
"refsource": "CONFIRM",
"url": "http://dev.piwik.org/trac/ticket/1279#comment:13"
},
{
"name": "http://piwik.org/blog/2011/01/piwik-1-1-2/",
"refsource": "CONFIRM",
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"name": "piwik-sessions-dos(64638)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64638"
},
{
"name": "70381",
"refsource": "OSVDB",
"url": "http://osvdb.org/70381"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0401",
"datePublished": "2011-01-10T19:18:00",
"dateReserved": "2011-01-10T00:00:00",
"dateUpdated": "2024-08-06T21:51:08.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2010-05-07 18:24
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:piwik:piwik:0.5.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7FB705E0-7652-4F50-B699-E775ABF02F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:piwik:piwik:0.5.5:rc2:*:*:*:*:*:*",
"matchCriteriaId": "5C87D0C5-900B-468F-8C05-46F6AE4076E1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el formulario de login en Piwik v0.1.6 hasta v0.5.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro \"form_url\"."
}
],
"id": "CVE-2010-1453",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-05-07T18:24:15.907",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39666"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/4"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/1079"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2010/04/piwik-0-6-security-advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39666"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/05/05/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/1079"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-11-20 15:15
Modified
2024-11-21 01:47
Severity ?
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| secalert@redhat.com | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| secalert@redhat.com | https://security-tracker.debian.org/tracker/CVE-2013-0195 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2013-0195 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C38FDFB-5B2F-4444-8873-2C25865A33F4",
"versionEndExcluding": "1.10.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site Scripting (XSS) en Piwik versiones anteriores a 1.10.1, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados. NOTA: Esta es una vulnerabilidad diferente de CVE-2013-0193 y CVE-2013-0194."
}
],
"id": "CVE-2013-0195",
"lastModified": "2024-11-21T01:47:02.413",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-11-20T15:15:11.333",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0195"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0195"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-21 21:55
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| matomo | matomo | * | |
| matomo | matomo | 1.0 | |
| matomo | matomo | 1.1 | |
| matomo | matomo | 1.1.1 | |
| matomo | matomo | 1.2 | |
| matomo | matomo | 1.2.1 | |
| matomo | matomo | 1.3 | |
| matomo | matomo | 1.4 | |
| matomo | matomo | 1.5 | |
| matomo | matomo | 1.5.1 | |
| matomo | matomo | 1.6 | |
| matomo | matomo | 1.7 | |
| matomo | matomo | 1.7.1 | |
| matomo | matomo | 1.8 | |
| matomo | matomo | 1.8.1 | |
| matomo | matomo | 1.8.2 | |
| matomo | matomo | 1.8.3 | |
| matomo | matomo | 1.8.4 | |
| matomo | matomo | 1.9.1 | |
| matomo | matomo | 1.9.2 | |
| matomo | matomo | 1.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F93E615-6268-450D-A140-405E00B28CE6",
"versionEndIncluding": "1.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E45F2630-A217-4F08-B36B-314AD69DD92D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "419A5DA8-D63D-4EAC-A4D5-4B5A1B7D4286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2891784E-0524-434C-9269-81C85C37D969",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "491C3F7C-889A-4E2A-A956-5ABB3836BAE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E38E65CD-4B1F-4D81-A818-6A4B0E312253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0E10E743-30FB-408C-A50B-BCAA0D750B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B80242D7-A09F-430A-9468-B52EBA6F6337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EF4B194B-C780-4005-A641-BCDB8A81FBE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C58F5320-BE2E-46D6-AFD8-BB298A10926F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F1D3535D-A8F1-42A2-BD7E-4EEFEF15C1F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0FFB1D11-C059-4CD4-9C38-8D2A7901BC8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA28DF4-8F43-4F35-9F1F-6A6C785B0CE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A33B1DF0-B069-4A72-A7AB-643E459FDB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C2869144-4413-469B-A6EE-31F5180BA10F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FACB8A22-2A07-4598-B8B6-27BC60F5E359",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2C56AA-46BA-4C13-8BA2-6C37AF63D5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3F8E33B0-6C43-4A7B-9BF4-9E3BC8D58880",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0B0054CC-1ADD-48B7-8174-DD867521FA58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C4CE48-9FE8-4FAF-A949-150038F723F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "692E334C-0A16-4770-BEBE-1824CCE20642",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Piwik anterior a v1.11 que permite a atacantes remotos inyectar un script web o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-1844",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-03-21T21:55:00.933",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/03/12/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/03/12/4"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-01-10 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "704ED1F9-3DA6-4A1E-951E-F45255B3CDCA",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9EFE3FEC-A95E-4547-82F6-FA0E1717F5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6AAF8BC0-AEB5-4CA9-805E-04F67B062034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AE4ECD-96BB-49B5-ABA7-907C0E76DA49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB3654ED-C8FB-47F2-B228-1F8C94AB280D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "50861060-3F5A-4B61-A727-EFCBF2956573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D0F87E4-E629-4735-819D-42D01B4D13F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54EACBCB-9F6D-4E7E-8CED-230C1C3E7DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5A562DAF-9386-4950-83B8-DAB6CAE88A95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BF3649F2-4BDA-4719-B696-A32D9DE03F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B0CE51-935E-4674-A1D8-92C7A289A5B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C19412A6-F05A-4EAD-9F31-8BC643782614",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados - (XSS) en Piwik antrior a v1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2011-0004",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-01-10T20:00:17.000",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/15"
},
{
"source": "secalert@redhat.com",
"url": "http://osvdb.org/70310"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42809"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/45659"
},
{
"source": "secalert@redhat.com",
"url": "http://www.vupen.com/english/advisories/2011/0013"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://openwall.com/lists/oss-security/2011/01/06/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-security-advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/professional-security-audit-in-piwik/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42809"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45659"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0013"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-01-10 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "704ED1F9-3DA6-4A1E-951E-F45255B3CDCA",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9EFE3FEC-A95E-4547-82F6-FA0E1717F5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6AAF8BC0-AEB5-4CA9-805E-04F67B062034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AE4ECD-96BB-49B5-ABA7-907C0E76DA49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB3654ED-C8FB-47F2-B228-1F8C94AB280D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "50861060-3F5A-4B61-A727-EFCBF2956573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D0F87E4-E629-4735-819D-42D01B4D13F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54EACBCB-9F6D-4E7E-8CED-230C1C3E7DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5A562DAF-9386-4950-83B8-DAB6CAE88A95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BF3649F2-4BDA-4719-B696-A32D9DE03F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B0CE51-935E-4674-A1D8-92C7A289A5B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C19412A6-F05A-4EAD-9F31-8BC643782614",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cookie.php in Piwik before 1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session."
},
{
"lang": "es",
"value": "Cookie.php en Piwik anterior a v1.1 no establece el indicador seguro para la cookie de sesi\u00f3n en una sesi\u00f3n https, lo que facilita a los atacantes remotos capturar esta cookie mediante la interceptaci\u00f3n de su transmisi\u00f3n entre una sesi\u00f3n http."
}
],
"id": "CVE-2011-0400",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-01-10T20:00:17.423",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/1795"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/70382"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64639"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/1795"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64639"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-16"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-05-20 16:29
Modified
2024-11-21 04:22
Severity ?
Summary
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/matomo-org/matomo/issues/14464 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/matomo-org/matomo/issues/14464 | Exploit, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1D513660-D70D-492C-99F7-41D619E86E0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating \"avoid reporting path disclosures, as we don\u0027t consider them as security vulnerabilities."
},
{
"lang": "es",
"value": "** EN DISPUTA ** Se descubri\u00f3 una vulnerabilidad de divulgaci\u00f3n de ruta completa en Matomo v3.9.1, donde un usuario puede desencadenar un error particular para descubrir la ruta completa de Matomo en el disco, porque lastError.file se usa en plugins/CorePluginsAdmin/templates/safemode.twig. NOTA: el proveedor cuestiona la importancia de este problema y dice \"evite la divulgaci\u00f3n de la informaci\u00f3n de las rutas de acceso, ya que no las consideramos como vulnerabilidades de seguridad\"."
}
],
"id": "CVE-2019-12215",
"lastModified": "2024-11-21T04:22:26.380",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-20T16:29:01.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/matomo-org/matomo/issues/14464"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/matomo-org/matomo/issues/14464"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-03-25 18:30
Modified
2025-04-09 00:30
Severity ?
Summary
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "43A7DB24-9CF1-4F80-AC3B-770416688084",
"versionEndIncluding": "0.2.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh."
},
{
"lang": "es",
"value": "Piwik v0.2.32 y anterioes almacenan informaci\u00f3n sensible bajo en directorio ra\u00edz Web con control de acceso insuficiente, lo que permite a atacantes remotos conseguir la clave API y otra informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n directa de misc/cron/archive.sh."
}
],
"id": "CVE-2009-1085",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-03-25T18:30:00.530",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/599"
},
{
"source": "cve@mitre.org",
"url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2009/03/23/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/599"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/03/23/2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-02-29 01:42
Modified
2025-04-01 15:25
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "522D2348-750A-45AA-BCC6-A374BB66580F",
"versionEndExcluding": "5.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Matomo Analytics \u2013 Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
},
{
"lang": "es",
"value": "El complemento Matomo Analytics \u2013 Ethical Stats. Powerful Insights para WordPress es vulnerable a Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro idsite en todas las versiones hasta la 4.15.3 incluida debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."
}
],
"id": "CVE-2023-6923",
"lastModified": "2025-04-01T15:25:41.127",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security@wordfence.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-29T01:42:49.007",
"references": [
{
"source": "security@wordfence.com",
"tags": [
"Patch"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3031495%40matomo\u0026new=3031495%40matomo\u0026sfp_email=\u0026sfph_mail="
},
{
"source": "security@wordfence.com",
"tags": [
"Third Party Advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=cve"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3031495%40matomo\u0026new=3031495%40matomo\u0026sfp_email=\u0026sfph_mail="
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e2d54eb-c176-49c4-a4fc-833e17189cad?source=cve"
}
],
"sourceIdentifier": "security@wordfence.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-01-10 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "704ED1F9-3DA6-4A1E-951E-F45255B3CDCA",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9EFE3FEC-A95E-4547-82F6-FA0E1717F5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6AAF8BC0-AEB5-4CA9-805E-04F67B062034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AE4ECD-96BB-49B5-ABA7-907C0E76DA49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB3654ED-C8FB-47F2-B228-1F8C94AB280D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "50861060-3F5A-4B61-A727-EFCBF2956573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D0F87E4-E629-4735-819D-42D01B4D13F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54EACBCB-9F6D-4E7E-8CED-230C1C3E7DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5A562DAF-9386-4950-83B8-DAB6CAE88A95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BF3649F2-4BDA-4719-B696-A32D9DE03F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B0CE51-935E-4674-A1D8-92C7A289A5B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C19412A6-F05A-4EAD-9F31-8BC643782614",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions."
},
{
"lang": "es",
"value": "Piwik en versiones anteriores a la 1.1 no limita apropiadamente el n\u00famero de ficheros almacenados bajo tmp/sessions/, lo que puede permitir a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de los recursos inode) estableciendo muchas sesiones."
}
],
"id": "CVE-2011-0401",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-01-10T20:00:17.470",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/1279#comment:13"
},
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/1910"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/70381"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64638"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/1279#comment:13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/1910"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64638"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-08-02 22:00
Modified
2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Piwik 0.6 through 0.6.3 allows remote attackers to include arbitrary local files and possibly have unspecified other impact via directory traversal sequences in a crafted data-renderer request."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en Piwik 0.6 a 0.6.3 permite a atacantes remotos incluir ficheros locales de su elecci\u00f3n y posiblemente tener otro impacto no especificado a trav\u00e9s de secuencias de salto de directorio en una petici\u00f3n manipulada data-renderer."
}
],
"id": "CVE-2010-2786",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-08-02T22:00:03.107",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://marc.info/?l=oss-security\u0026m=128032989120346\u0026w=2"
},
{
"source": "secalert@redhat.com",
"url": "http://marc.info/?l=oss-security\u0026m=128041221832498\u0026w=2"
},
{
"source": "secalert@redhat.com",
"url": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/"
},
{
"source": "secalert@redhat.com",
"url": "http://piwik.org/changelog/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40703"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/66759"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/42031"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/1971"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60808"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=128032989120346\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=128041221832498\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://piwik.org/blog/2010/07/piwik-0-6-4-security-advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://piwik.org/changelog/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40703"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/66759"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/42031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/1971"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/60808"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-21 21:55
Modified
2025-04-11 00:51
Severity ?
Summary
Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| matomo | matomo | * | |
| matomo | matomo | 1.0 | |
| matomo | matomo | 1.1 | |
| matomo | matomo | 1.1.1 | |
| matomo | matomo | 1.2 | |
| matomo | matomo | 1.2.1 | |
| matomo | matomo | 1.3 | |
| matomo | matomo | 1.4 | |
| matomo | matomo | 1.5 | |
| matomo | matomo | 1.5.1 | |
| matomo | matomo | 1.6 | |
| matomo | matomo | 1.7 | |
| matomo | matomo | 1.7.1 | |
| matomo | matomo | 1.8 | |
| matomo | matomo | 1.8.1 | |
| matomo | matomo | 1.8.2 | |
| matomo | matomo | 1.8.3 | |
| matomo | matomo | 1.8.4 | |
| matomo | matomo | 1.9.1 | |
| matomo | matomo | 1.9.2 | |
| matomo | matomo | 1.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1F93E615-6268-450D-A140-405E00B28CE6",
"versionEndIncluding": "1.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E45F2630-A217-4F08-B36B-314AD69DD92D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "419A5DA8-D63D-4EAC-A4D5-4B5A1B7D4286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2891784E-0524-434C-9269-81C85C37D969",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "491C3F7C-889A-4E2A-A956-5ABB3836BAE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E38E65CD-4B1F-4D81-A818-6A4B0E312253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0E10E743-30FB-408C-A50B-BCAA0D750B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B80242D7-A09F-430A-9468-B52EBA6F6337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EF4B194B-C780-4005-A641-BCDB8A81FBE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C58F5320-BE2E-46D6-AFD8-BB298A10926F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F1D3535D-A8F1-42A2-BD7E-4EEFEF15C1F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0FFB1D11-C059-4CD4-9C38-8D2A7901BC8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2FA28DF4-8F43-4F35-9F1F-6A6C785B0CE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A33B1DF0-B069-4A72-A7AB-643E459FDB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C2869144-4413-469B-A6EE-31F5180BA10F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FACB8A22-2A07-4598-B8B6-27BC60F5E359",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2C56AA-46BA-4C13-8BA2-6C37AF63D5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3F8E33B0-6C43-4A7B-9BF4-9E3BC8D58880",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0B0054CC-1ADD-48B7-8174-DD867521FA58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9C4CE48-9FE8-4FAF-A949-150038F723F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "692E334C-0A16-4770-BEBE-1824CCE20642",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.11 accepts input from a POST request instead of a GET request in unspecified circumstances, which might allow attackers to obtain sensitive information by leveraging the logging of parameters."
},
{
"lang": "es",
"value": "Piwik anterior a v1.11 acepta entradas desde una petici\u00f3n POST en lugar de una petici\u00f3n GET en circunstancias sin especificar, lo que puede permitir ataques para conseguir informaci\u00f3n a trav\u00e9s del aprovechamiento de los par\u00e1metros del login."
}
],
"id": "CVE-2013-2633",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-21T21:55:01.003",
"references": [
{
"source": "cve@mitre.org",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://piwik.org/blog/2013/03/piwik-1-11/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-12-24 16:30
Modified
2025-04-09 00:30
Severity ?
Summary
The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the unserialize function, which allows remote attackers to execute arbitrary code or upload arbitrary files via vectors related to the __destruct function in the Piwik_Config class; php://filter URIs; the __destruct functions in Zend Framework, as demonstrated by the Zend_Log destructor; the shutdown functions in Zend Framework, as demonstrated by the Zend_Log_Writer_Mail class; the render function in the Piwik_View class; Smarty templates; and the _eval function in Smarty."
},
{
"lang": "es",
"value": "La funci\u00f3n loadContentFromCookie en core/Cookie.php en Piwik before v0.5 no valida cadenas obtenidoas desde cookies antes de llamar a la funci\u00f3n unserialize, lo que permite a atacantes remotos ejecuta c\u00f3digo o cargar archivos de su elecci\u00f3n a trav\u00e9s de vectores relacionados con la funci\u00f3n the __destruct en la clase Piwik_Config; php://filter URIs; las funciones __destruct en Zend Framework, como qued\u00f3 demostrado por el destructor Zend_Log; las funciones shutdown en Zend Framework, como qued\u00f3 demostrado por la clase Zend_Log_Writer_Mail; la funci\u00f3n render en la clase Piwik_View; plantillas Smarty ; y la funci\u00f3n _eval en Smarty."
}
],
"id": "CVE-2009-4137",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-12-24T16:30:00.250",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.piwik.org/trac/changeset/1637"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2009/12/09/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2009/12/10/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.piwik.org/trac/changeset/1637"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2009/12/piwik-response-to-shocking-news-in-php-exploitation/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/12/09/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/12/10/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.suspekt.org/2009/12/09/advisory-032009-piwik-cookie-unserialize-vulnerability/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-12-22 22:30
Modified
2025-04-09 00:30
Severity ?
Summary
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| teethgrinder.co.uk | open_flash_chart | 2.0 | |
| matomo | matomo | 0.2.37 | |
| matomo | matomo | 0.4.2 | |
| matomo | matomo | 0.4.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:beta_1:*:*:*:*:*:*",
"matchCriteriaId": "CAFD137D-4772-49C4-8EDE-74F838BFB1D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:gamera:*:*:*:*:*:*",
"matchCriteriaId": "F9FC6227-6C33-4533-9263-C43CC218E314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:hyperion:*:*:*:*:*:*",
"matchCriteriaId": "7AE13D32-E4A6-4274-9AAF-8CFB37E0CC4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:ichor:*:*:*:*:*:*",
"matchCriteriaId": "EFFC03CB-7773-4CAF-AF9D-E2F50FDB8F1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:j_rmungandr:*:*:*:*:*:*",
"matchCriteriaId": "4C0AEFA3-7433-4A79-BED0-0C44FBB916BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:j_rmungandr-2:*:*:*:*:*:*",
"matchCriteriaId": "9C544F30-E14B-4B34-B8E8-6F984ECEF72A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:kvasir:*:*:*:*:*:*",
"matchCriteriaId": "139C1538-502B-41FC-9DB7-229F5FD3A939",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:teethgrinder.co.uk:open_flash_chart:2.0:lug_wyrm_charmer:*:*:*:*:*:*",
"matchCriteriaId": "014A2738-B528-472F-8E0F-A206F9D423C3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.37:*:*:*:*:*:*:*",
"matchCriteriaId": "D0FD1280-C769-4B8D-B0F4-26B405E080CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "863EB628-3970-4F96-81E8-827FCDAE91E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5617FB7C-649A-44FD-A9F8-2275F51EFA71",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/."
},
{
"lang": "es",
"value": "Una vulnerabilidad de carga de archivos sin restricciones en el archivo ofc_upload_image.php en Open Flash Chart versi\u00f3n v2 Beta 1 hasta v2 Lug Wyrm Charmer, tal como es usado en Piwik versiones 0.2.35 hasta 0.4.3, Plugin Woopra Analytics anterior a versi\u00f3n 1.4.3.2, y posiblemente otros productos, cuando register_globals est\u00e1 habilitado, permite a los usuarios autenticados remotos ejecutar c\u00f3digo arbitrario mediante la carga de un archivo con una extensi\u00f3n ejecutable por medio del par\u00e1metro name con el c\u00f3digo en el par\u00e1metro HTTP_RAW_POST_DATA, a continuaci\u00f3n, acceder a \u00e9l por medio de una petici\u00f3n directa al archivo en tmp-upload-images/"
}
],
"id": "CVE-2009-4140",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-12-22T22:30:00.530",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt"
},
{
"source": "secalert@redhat.com",
"url": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37078"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37911"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/55160"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/55162"
},
{
"source": "secalert@redhat.com",
"url": "http://wordpress.org/extend/plugins/woopra/changelog/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.exploit-db.com/exploits/24969"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/59051"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/37314"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2966"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53825"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/123493/wpseowatcher-exec.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/123494/wpslimstatex-exec.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/0910-exploits/piwik-upload.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2009/10/piwik-response-to-secunia-advisory-sa37078/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37911"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/55160"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/55162"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://wordpress.org/extend/plugins/woopra/changelog/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.exploit-db.com/exploits/24969"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/12/14/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/59051"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/37314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2966"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53825"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-11-20 15:15
Modified
2024-11-21 01:47
Severity ?
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| secalert@redhat.com | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| secalert@redhat.com | https://security-tracker.debian.org/tracker/CVE-2013-0194 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2013-0194 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C38FDFB-5B2F-4444-8873-2C25865A33F4",
"versionEndExcluding": "1.10.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site Scripting (XSS) en Piwik versiones anteriores a la versi\u00f3n 1.10.1, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados. NOTA: Esta es una vulnerabilidad diferente de CVE-2013-0193 y CVE-2013-0195."
}
],
"id": "CVE-2013-0194",
"lastModified": "2024-11-21T01:47:02.293",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-11-20T15:15:11.240",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0194"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0194"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-09-18 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "491C3F7C-889A-4E2A-A956-5ABB3836BAE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E38E65CD-4B1F-4D81-A818-6A4B0E312253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0E10E743-30FB-408C-A50B-BCAA0D750B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B80242D7-A09F-430A-9468-B52EBA6F6337",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en Piwik v1.2 hasta v1.4, permite a atacantes remotos con permisos de visualizaci\u00f3n, ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de vectores de ataque desconocidos"
}
],
"id": "CVE-2011-4941",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-09-18T18:55:01.020",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/03/18/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/03/19/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://piwik.org/blog/2011/06/piwik-1-5-security-advisory/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/03/18/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/03/19/8"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-11-20 15:15
Modified
2024-11-21 01:47
Severity ?
Summary
Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| secalert@redhat.com | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| secalert@redhat.com | https://security-tracker.debian.org/tracker/CVE-2013-0193 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/01/17/15 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://matomo.org/changelog/piwik-1-10/ | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security-tracker.debian.org/tracker/CVE-2013-0193 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C38FDFB-5B2F-4444-8873-2C25865A33F4",
"versionEndExcluding": "1.10.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site Scripting (XSS) en Piwik versiones anteriores a la versi\u00f3n 1.10.1, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados. NOTA: Esta es una vulnerabilidad diferente de CVE-2013-0194 y CVE-2013-0195."
}
],
"id": "CVE-2013-0193",
"lastModified": "2024-11-21T01:47:02.157",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-11-20T15:15:11.177",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0193"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/01/17/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://matomo.org/changelog/piwik-1-10/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security-tracker.debian.org/tracker/CVE-2013-0193"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-01-10 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "704ED1F9-3DA6-4A1E-951E-F45255B3CDCA",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9EFE3FEC-A95E-4547-82F6-FA0E1717F5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6AAF8BC0-AEB5-4CA9-805E-04F67B062034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AE4ECD-96BB-49B5-ABA7-907C0E76DA49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB3654ED-C8FB-47F2-B228-1F8C94AB280D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "50861060-3F5A-4B61-A727-EFCBF2956573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D0F87E4-E629-4735-819D-42D01B4D13F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54EACBCB-9F6D-4E7E-8CED-230C1C3E7DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5A562DAF-9386-4950-83B8-DAB6CAE88A95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BF3649F2-4BDA-4719-B696-A32D9DE03F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B0CE51-935E-4674-A1D8-92C7A289A5B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C19412A6-F05A-4EAD-9F31-8BC643782614",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Piwik before 1.1 does not prevent the rendering of the login form inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site."
},
{
"lang": "es",
"value": "Piwik antes de 1.1 no previene la representaci\u00f3n del formulario de conexi\u00f3n dentro de un marco en un documento HTML de terceros, lo que facilita a los atacantes remotos realizar ataques de clickjacking mediante un sitio web manipulado."
}
],
"id": "CVE-2011-0399",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-01-10T20:00:17.203",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/1679"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/70383"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64640"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/1679"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70383"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64640"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-11-16 19:59
Modified
2025-04-12 10:46
Severity ?
Summary
The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0D0E855-7817-4341-B32A-F508842FC8CC",
"versionEndIncluding": "2.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery (SSRF) attacks, and execute arbitrary PHP code via a crafted HTTP header."
},
{
"lang": "es",
"value": "La funci\u00f3n DisplayTopKeywords en plugins/Referrers/Controller.php en Piwik en versiones anteriores a 2.15.0 permite a atacantes remotos llevar a cabo ataques de inyecci\u00f3n de objetos PHP, ejecutar ataques de SSRF y ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de una cabecera HTTP manipulada."
}
],
"evaluatorComment": "\u003ca href=\"https://cwe.mitre.org/data/definitions/918.html\"\u003eCWE-918: Server-Side Request Forgery (SSRF)\u003c/a\u003e",
"id": "CVE-2015-7816",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-11-16T19:59:05.707",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://karmainsecurity.com/KIS-2015-10"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/15"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/536839/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://karmainsecurity.com/KIS-2015-10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/134220/Piwik-2.14.3-PHP-Object-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/536839/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-11-19 12:10
Modified
2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99DAAC69-194C-4FCC-B6B1-5DD84139E9F5",
"versionEndIncluding": "1.8.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E45F2630-A217-4F08-B36B-314AD69DD92D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "491C3F7C-889A-4E2A-A956-5ABB3836BAE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E38E65CD-4B1F-4D81-A818-6A4B0E312253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0E10E743-30FB-408C-A50B-BCAA0D750B82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B80242D7-A09F-430A-9468-B52EBA6F6337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EF4B194B-C780-4005-A641-BCDB8A81FBE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C58F5320-BE2E-46D6-AFD8-BB298A10926F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F1D3535D-A8F1-42A2-BD7E-4EEFEF15C1F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0FFB1D11-C059-4CD4-9C38-8D2A7901BC8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "A33B1DF0-B069-4A72-A7AB-643E459FDB11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C2869144-4413-469B-A6EE-31F5180BA10F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FACB8A22-2A07-4598-B8B6-27BC60F5E359",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:1.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2C56AA-46BA-4C13-8BA2-6C37AF63D5B3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Piwik antes de v1.9 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2012-4541",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-11-19T12:10:52.510",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://piwik.org/blog/2012/10/piwik-1-9/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/10/22/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/10/23/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://piwik.org/blog/2012/10/piwik-1-9/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/10/22/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/10/23/2"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-11-16 19:59
Modified
2025-04-12 10:46
Severity ?
Summary
Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D0D0E855-7817-4341-B32A-F508842FC8CC",
"versionEndIncluding": "2.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in core/ViewDataTable/Factory.php in Piwik before 2.15.0 allows remote attackers to include and execute arbitrary local files via the viewDataTable parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en core/ViewDataTable/Factory.php en Piwik en versiones anteriores a 2.15.0 permite a atacantes remotos incluir y ejecutar archivos locales arbitrarios a trav\u00e9s del par\u00e1metro viewDataTable."
}
],
"id": "CVE-2015-7815",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-11-16T19:59:04.440",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://karmainsecurity.com/KIS-2015-09"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/14"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/536838/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://karmainsecurity.com/KIS-2015-09"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/134219/Piwik-2.14.3-Local-File-Inclusion.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://seclists.org/fulldisclosure/2015/Nov/14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/536838/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://piwik.org/changelog/piwik-2-15-0/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-01-10 20:00
Modified
2025-04-11 00:51
Severity ?
Summary
The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "704ED1F9-3DA6-4A1E-951E-F45255B3CDCA",
"versionEndIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9EFE3FEC-A95E-4547-82F6-FA0E1717F5A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6AAF8BC0-AEB5-4CA9-805E-04F67B062034",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4AE4ECD-96BB-49B5-ABA7-907C0E76DA49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB3654ED-C8FB-47F2-B228-1F8C94AB280D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "50861060-3F5A-4B61-A727-EFCBF2956573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D0F87E4-E629-4735-819D-42D01B4D13F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "575F3475-319E-47E5-8B24-B8CF8FF1999B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "14E9E4A9-484C-4778-A9A6-8985F50C86E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "5C1C34AD-ED5C-4F4E-B987-052A7BDD96D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "683763A0-50EA-4B60-A356-D1215153FBD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B08D1E94-8CA5-4CFF-A851-BDEEB14FE2C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "23405228-A62F-4247-9F62-8F41DF12CC79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0DF19F16-95A2-4CB7-8049-8327E80A52E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BB28EFFC-891D-44CA-A8A8-B10A95206A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "1372728F-8DDF-476C-8F6E-EFCF49C35EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B71E1-CE28-42D5-BF82-1C0A14C51233",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A226F1B7-2050-4102-8546-1C4B38FDAC7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "D1F56B7D-C131-418C-ABD6-DDCA105E8E0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B201D593-5696-47E3-8FA5-97DAECEE405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "6C1F7635-DFD1-4847-937F-6020CDE1BC7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2062372A-C061-435F-A563-FA717A562793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7E605BE7-8750-450E-871F-5CDE57D2528C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "7A613D1F-FA93-4459-B49B-5A96CF64F772",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "BF1D373B-4001-46FA-A99D-44E69E4D7D33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "E74FA628-CBA0-4E9E-BA53-0035C6BE877E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "665BF716-5845-4CD8-B33B-FAC8C29D2E82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "833F0705-FB08-416E-920C-DF6324E88775",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "925FC533-97C4-4D74-8841-1D92E32D52DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "611713A4-00A0-48FA-8845-716053BBB084",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "424082B7-1182-4419-A8AA-CFD7A38CAF84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "64D44CAA-4779-4B17-B03D-5ECB146A613A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.23:*:*:*:*:*:*:*",
"matchCriteriaId": "C790AE91-82E3-476E-ADEF-A1B6178AC817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.24:*:*:*:*:*:*:*",
"matchCriteriaId": "FC388DDD-1C79-4B89-A75A-7BF06893276F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.25:*:*:*:*:*:*:*",
"matchCriteriaId": "262A0DB0-6CE4-41E7-BDC6-18924C76EDCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.26:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F37F31-2288-4B86-9EEB-38EE8B1979C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.27:*:*:*:*:*:*:*",
"matchCriteriaId": "74DBC09F-4B09-490B-8367-93B3257F9DBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.28:*:*:*:*:*:*:*",
"matchCriteriaId": "0384553E-FEEB-4AE4-B1F1-1EC99BE07BD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.29:*:*:*:*:*:*:*",
"matchCriteriaId": "E64C21FE-BCA5-4830-AA85-5959CBE3800D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.30:*:*:*:*:*:*:*",
"matchCriteriaId": "BF976D83-866E-416D-A21C-2BF2A8F95462",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.31:*:*:*:*:*:*:*",
"matchCriteriaId": "1E9EB7C0-C645-4E1A-A7CD-87325BBA81E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.32:*:*:*:*:*:*:*",
"matchCriteriaId": "998651DF-2552-4A8E-9EA9-AEEED3D39BCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.33:*:*:*:*:*:*:*",
"matchCriteriaId": "1C0BC4C8-ECBE-488B-ABE8-5A080FBF5AC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.2.34:*:*:*:*:*:*:*",
"matchCriteriaId": "288685F8-8F1D-4019-B5D1-AADF38622ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "90ED76A7-37BB-4438-83E8-86A826B6CA53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "392788F8-7ECC-4BCD-B415-B14C8B57E117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "340C02F9-D975-4954-B952-D4F970483F82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5AE2C007-7B53-40CE-9ABA-E2F56A2329C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C26D8F47-9BDD-4A57-815D-409BFAF2CE91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CB9824A-589E-436C-BD11-C5936B492BAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2C95F489-6E9F-4F5E-A79B-473D3E2D6FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B28488E4-C6CD-41C1-BEE0-85D495E5ED5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D034FA2E-3DAF-44C7-8405-EC39DDDE1DF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6E02CFA8-FDDC-47A7-BD98-4AF242655D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F15AEAB-C240-4348-B6A9-597E338D4968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D45F0B05-26A5-492D-972C-0AA7487B5355",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "397FD5B1-7C9A-42E4-97F8-C40AEF6E32F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CEDF7FD4-F402-43E9-974E-346AA70E6A04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "19CCD7BB-FBAD-4AFA-A58A-95FCFB31BC6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B94A273B-5B78-44A5-B1BC-BE6640D1ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "242DD619-FB08-48CB-9C1F-009A8E0B0857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "32BA76C7-1E11-4526-BAE4-5ED6DB3C731F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54EACBCB-9F6D-4E7E-8CED-230C1C3E7DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "5A562DAF-9386-4950-83B8-DAB6CAE88A95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BF3649F2-4BDA-4719-B696-A32D9DE03F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F8B0CE51-935E-4674-A1D8-92C7A289A5B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:matomo:matomo:0.9.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C19412A6-F05A-4EAD-9F31-8BC643782614",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Piwik_Common::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via (1) use of a private (aka RFC 1918) address behind a proxy server or (2) spoofing of the X-Forwarded-For HTTP header."
},
{
"lang": "es",
"value": "La funci\u00f3n Piwik_Common::getIP de Piwik en versiones anteriores a la 1.1 no determina apropiadamente la direcci\u00f3n IP cliente, lo que permite a atacantes remotos evitar laS funcionalidades de geolocalizaci\u00f3n y auditor\u00eda previstas a trav\u00e9s de (1) el uso de una direcci\u00f3n privada (RFC 1918) detr\u00e1s de un servidor proxy o (2) suplantando la cabecera HTTP X-Forwarded-For."
}
],
"id": "CVE-2011-0398",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-01-10T20:00:17.140",
"references": [
{
"source": "cve@mitre.org",
"url": "http://dev.piwik.org/trac/ticket/567"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/70384"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64641"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dev.piwik.org/trac/ticket/567"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/70384"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://piwik.org/blog/2011/01/piwik-1-1-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64641"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-24 00:55
Modified
2025-04-11 00:51
Severity ?
Summary
Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:matomo:matomo:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "419A5DA8-D63D-4EAC-A4D5-4B5A1B7D4286",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Piwik 1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Widgetize/Widgetize.php and certain other files."
},
{
"lang": "es",
"value": "Piwik v1.1 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n directa a un archivo .php, lo que revela la ruta de instalaci\u00f3n en un mensaje de error, como se demostr\u00f3 con plugins/Widgetize/Widgetize.php y algunos otros archivos."
}
],
"id": "CVE-2011-3791",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-09-24T00:55:02.863",
"references": [
{
"source": "cve@mitre.org",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "cve@mitre.org",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/piwik-1.1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}