Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
52 vulnerabilities by moinmo
CVE-2020-15275 (GCVE-0-2020-15275)
Vulnerability from cvelistv5 – Published: 2020-11-11 15:45 – Updated: 2024-08-04 13:15
VLAI
EPSS
VEX
Title
malicious SVG attachment causing stored XSS vulnerability in MoinMoin
Summary
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Severity
8.7 (High)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moinwiki/moin-1.9/security/adv… | x_refsource_CONFIRM |
| https://github.com/moinwiki/moin-1.9/releases/tag… | x_refsource_MISC |
| https://github.com/moinwiki/moin-1.9/commit/31de9… | x_refsource_MISC |
| https://advisory.checkmarx.net/advisory/CX-2020-4285 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:15:19.004Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "moin-1.9",
"vendor": "moinwiki",
"versions": [
{
"status": "affected",
"version": "\u003c 1.9.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user\u0027s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-30T21:15:23.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
],
"source": {
"advisory": "GHSA-4q96-6xhq-ff43",
"discovery": "UNKNOWN"
},
"title": "malicious SVG attachment causing stored XSS vulnerability in MoinMoin",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-15275",
"STATE": "PUBLIC",
"TITLE": "malicious SVG attachment causing stored XSS vulnerability in MoinMoin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "moin-1.9",
"version": {
"version_data": [
{
"version_value": "\u003c 1.9.11"
}
]
}
}
]
},
"vendor_name": "moinwiki"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user\u0027s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43",
"refsource": "CONFIRM",
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"name": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"name": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"name": "https://advisory.checkmarx.net/advisory/CX-2020-4285",
"refsource": "MISC",
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
]
},
"source": {
"advisory": "GHSA-4q96-6xhq-ff43",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-15275",
"datePublished": "2020-11-11T15:45:15.000Z",
"dateReserved": "2020-06-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T13:15:19.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25074 (GCVE-0-2020-25074)
Vulnerability from cvelistv5 – Published: 2020-11-10 16:48 – Updated: 2024-08-04 15:26
VLAI
EPSS
VEX
Summary
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://moinmo.in/SecurityFixes | x_refsource_MISC |
| https://www.debian.org/security/2020/dsa-4787 | vendor-advisoryx_refsource_DEBIAN |
| https://github.com/moinwiki/moin-1.9/security/adv… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:09.287Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-11T00:06:11.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-25074",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "MISC",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"name": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-25074",
"datePublished": "2020-11-10T16:48:21.000Z",
"dateReserved": "2020-09-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:26:09.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5934 (GCVE-0-2017-5934)
Vulnerability from cvelistv5 – Published: 2018-10-15 19:00 – Updated: 2024-08-05 15:18
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/moinwiki/moin-1.9/commit/70955… | x_refsource_CONFIRM |
| https://www.debian.org/security/2018/dsa-4318 | vendor-advisoryx_refsource_DEBIAN |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2018… | mailing-listx_refsource_MLIST |
| https://usn.ubuntu.com/3794-1/ | vendor-advisoryx_refsource_UBUNTU |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Date Public
2018-09-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:48.414Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5934",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024",
"refsource": "CONFIRM",
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5934",
"datePublished": "2018-10-15T19:00:00.000Z",
"dateReserved": "2017-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:18:48.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-9119 (GCVE-0-2016-9119)
Vulnerability from cvelistv5 – Published: 2017-01-30 22:00 – Updated: 2024-08-06 02:42
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/94501 | vdb-entryx_refsource_BID |
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
Date Public
2016-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:42:10.472Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-31T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9119",
"datePublished": "2017-01-30T22:00:00.000Z",
"dateReserved": "2016-10-30T00:00:00.000Z",
"dateUpdated": "2024-08-06T02:42:10.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7146 (GCVE-0-2016-7146)
Vulnerability from cvelistv5 – Published: 2016-11-10 17:00 – Updated: 2024-08-06 01:50
VLAI
EPSS
VEX
Summary
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.securityfocus.com/bid/94259 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
| https://www.curesec.com/blog/article/blog/MoinMoi… | x_refsource_MISC |
Date Public
2016-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation or crafted URL\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=fckdialog\u0026dialog=attachment (via page name) component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-30T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7146",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation or crafted URL\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=fckdialog\u0026dialog=attachment (via page name) component."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"name": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html",
"refsource": "MISC",
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7146",
"datePublished": "2016-11-10T17:00:00.000Z",
"dateReserved": "2016-09-05T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7148 (GCVE-0-2016-7148)
Vulnerability from cvelistv5 – Published: 2016-11-10 17:00 – Updated: 2024-08-06 01:50
VLAI
EPSS
VEX
Summary
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.securityfocus.com/bid/94259 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
| https://www.curesec.com/blog/article/blog/MoinMoi… | x_refsource_MISC |
Date Public
2016-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.471Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-30T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7148",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"name": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html",
"refsource": "MISC",
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7148",
"datePublished": "2016-11-10T17:00:00.000Z",
"dateReserved": "2016-09-05T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6080 (GCVE-0-2012-6080)
Vulnerability from cvelistv5 – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
10 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/57076 | vdb-entryx_refsource_BID |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://secunia.com/advisories/51676 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 | x_refsource_CONFIRM |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.openwall.com/lists/oss-security/2012/12/30/6 | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "57076",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57076"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51676"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (path traversal vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "57076",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57076"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51676"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (path traversal vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6080",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6495 (GCVE-0-2012-6495)
Vulnerability from cvelistv5 – Published: 2013-01-03 01:00 – Updated: 2024-09-16 23:26
VLAI
EPSS
VEX
Summary
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://www.openwall.com/lists/oss-security/2012/12/29/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2012/12/30/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:28:39.825Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6495",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1680-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6495",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2013-01-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:26:18.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6082 (GCVE-0-2012-6082)
Vulnerability from cvelistv5 – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://www.openwall.com/lists/oss-security/2012/12/30/5 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/rev/c98ec456e493 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/57089 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2012/12/29/7 | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/c98ec456e493"
},
{
"name": "57089",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57089"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/c98ec456e493"
},
{
"name": "57089",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57089"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6082",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6081 (GCVE-0-2012-6081)
Vulnerability from cvelistv5 – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://www.securityfocus.com/bid/57082 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2012/12/29/6 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51676 | third-party-advisoryx_refsource_SECUNIA |
| http://www.openwall.com/lists/oss-security/2012/12/30/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://www.exploit-db.com/exploits/25304 | exploitx_refsource_EXPLOIT-DB |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
Date Public
2012-12-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.522Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "57082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57082"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51676"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "25304",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/25304"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-12-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-10T15:57:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "57082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57082"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51676"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "25304",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/25304"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6081",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-4404 (GCVE-0-2012-4404)
Vulnerability from cvelistv5 – Published: 2012-09-10 22:00 – Updated: 2024-08-06 20:35
VLAI
EPSS
VEX
Summary
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-1604-1 | vendor-advisoryx_refsource_UBUNTU |
| http://secunia.com/advisories/50496 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2538 | vendor-advisoryx_refsource_DEBIAN |
| http://www.openwall.com/lists/oss-security/2012/09/04/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/50885 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/50474 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2012/09/05/2 | mailing-listx_refsource_MLIST |
Date Public
2012-09-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:35:09.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "50496",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50496"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2538",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2538"
},
{
"name": "[oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/04/4"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "50474",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50474"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16"
},
{
"name": "[oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/05/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as \"All,\" \"Known,\" or \"Trusted,\" which allows remote authenticated users with virtual group membership to be treated as a member of the group."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-10-30T09:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "50496",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50496"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2538",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2538"
},
{
"name": "[oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/04/4"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "50474",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50474"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16"
},
{
"name": "[oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/05/2"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-4404",
"datePublished": "2012-09-10T22:00:00.000Z",
"dateReserved": "2012-08-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T20:35:09.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1058 (GCVE-0-2011-1058)
Vulnerability from cvelistv5 – Published: 2011-02-22 17:00 – Updated: 2024-08-06 22:14
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
14 references
Date Public
2011-02-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "46476",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "46476",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1058",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "46476",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1058",
"datePublished": "2011-02-22T17:00:00.000Z",
"dateReserved": "2011-02-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T22:14:27.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2970 (GCVE-0-2010-2970)
Vulnerability from cvelistv5 – Published: 2010-08-04 21:00 – Updated: 2024-09-17 00:16
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2010/1981 | vdb-entryx_refsource_VUPEN |
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/40549 | vdb-entryx_refsource_BID |
| http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb | x_refsource_CONFIRM |
| http://www.debian.org/security/2010/dsa-2083 | vendor-advisoryx_refsource_DEBIAN |
| http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 | x_refsource_CONFIRM |
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 | x_refsource_CONFIRM |
| http://marc.info/?l=oss-security&m=127799369406968&w=2 | mailing-listx_refsource_MLIST |
| http://marc.info/?l=oss-security&m=127809682420259&w=2 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/… | x_refsource_CONFIRM |
| http://secunia.com/advisories/40836 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInput… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:45.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2970",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2010-1981",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809",
"refsource": "CONFIRM",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"name": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40836"
},
{
"name": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2970",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-08-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:31.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2969 (GCVE-0-2010-2969)
Vulnerability from cvelistv5 – Published: 2010-08-04 21:00 – Updated: 2024-09-16 20:38
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2010/1981 | vdb-entryx_refsource_VUPEN |
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/40549 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2010/dsa-2083 | vendor-advisoryx_refsource_DEBIAN |
| http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 | x_refsource_CONFIRM |
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 | x_refsource_CONFIRM |
| http://marc.info/?l=oss-security&m=127799369406968&w=2 | mailing-listx_refsource_MLIST |
| http://marc.info/?l=oss-security&m=127809682420259&w=2 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/… | x_refsource_CONFIRM |
| http://hg.moinmo.in/moin/1.7/rev/37306fba2189 | x_refsource_CONFIRM |
| http://secunia.com/advisories/40836 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInput… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:46.399Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2969",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2010-1981",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809",
"refsource": "CONFIRM",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"name": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40836"
},
{
"name": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2969",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-08-04T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:38:11.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2487 (GCVE-0-2010-2487)
Vulnerability from cvelistv5 – Published: 2010-08-04 21:00 – Updated: 2024-08-07 02:32
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
17 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.844Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.8/rev/4238b0c90871"
},
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/68ba3cc79513"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.8/rev/4238b0c90871"
},
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/68ba3cc79513"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2487",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-06-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T02:32:16.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-15275 (GCVE-0-2020-15275)
Vulnerability from nvd – Published: 2020-11-11 15:45 – Updated: 2024-08-04 13:15
VLAI
EPSS
VEX
Title
malicious SVG attachment causing stored XSS vulnerability in MoinMoin
Summary
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Severity
8.7 (High)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moinwiki/moin-1.9/security/adv… | x_refsource_CONFIRM |
| https://github.com/moinwiki/moin-1.9/releases/tag… | x_refsource_MISC |
| https://github.com/moinwiki/moin-1.9/commit/31de9… | x_refsource_MISC |
| https://advisory.checkmarx.net/advisory/CX-2020-4285 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:15:19.004Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "moin-1.9",
"vendor": "moinwiki",
"versions": [
{
"status": "affected",
"version": "\u003c 1.9.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user\u0027s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-30T21:15:23.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
],
"source": {
"advisory": "GHSA-4q96-6xhq-ff43",
"discovery": "UNKNOWN"
},
"title": "malicious SVG attachment causing stored XSS vulnerability in MoinMoin",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-15275",
"STATE": "PUBLIC",
"TITLE": "malicious SVG attachment causing stored XSS vulnerability in MoinMoin"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "moin-1.9",
"version": {
"version_data": [
{
"version_value": "\u003c 1.9.11"
}
]
}
}
]
},
"vendor_name": "moinwiki"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user\u0027s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43",
"refsource": "CONFIRM",
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43"
},
{
"name": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11"
},
{
"name": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2"
},
{
"name": "https://advisory.checkmarx.net/advisory/CX-2020-4285",
"refsource": "MISC",
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4285"
}
]
},
"source": {
"advisory": "GHSA-4q96-6xhq-ff43",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2020-15275",
"datePublished": "2020-11-11T15:45:15.000Z",
"dateReserved": "2020-06-25T00:00:00.000Z",
"dateUpdated": "2024-08-04T13:15:19.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-25074 (GCVE-0-2020-25074)
Vulnerability from nvd – Published: 2020-11-10 16:48 – Updated: 2024-08-04 15:26
VLAI
EPSS
VEX
Summary
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://moinmo.in/SecurityFixes | x_refsource_MISC |
| https://www.debian.org/security/2020/dsa-4787 | vendor-advisoryx_refsource_DEBIAN |
| https://github.com/moinwiki/moin-1.9/security/adv… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:26:09.287Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-11T00:06:11.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-25074",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "MISC",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-4787",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2020/dsa-4787"
},
{
"name": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq",
"refsource": "MISC",
"url": "https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq"
},
{
"name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2446-1] moin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-25074",
"datePublished": "2020-11-10T16:48:21.000Z",
"dateReserved": "2020-09-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T15:26:09.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5934 (GCVE-0-2017-5934)
Vulnerability from nvd – Published: 2018-10-15 19:00 – Updated: 2024-08-05 15:18
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/moinwiki/moin-1.9/commit/70955… | x_refsource_CONFIRM |
| https://www.debian.org/security/2018/dsa-4318 | vendor-advisoryx_refsource_DEBIAN |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2018… | mailing-listx_refsource_MLIST |
| https://usn.ubuntu.com/3794-1/ | vendor-advisoryx_refsource_UBUNTU |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
Date Public
2018-09-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:48.414Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5934",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024",
"refsource": "CONFIRM",
"url": "https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024"
},
{
"name": "DSA-4318",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2018/dsa-4318"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "[debian-lts-announce] 20181015 [SECURITY] [DLA 1546-1] moin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html"
},
{
"name": "USN-3794-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3794-1/"
},
{
"name": "openSUSE-SU-2018:3105",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5934",
"datePublished": "2018-10-15T19:00:00.000Z",
"dateReserved": "2017-02-08T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:18:48.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-9119 (GCVE-0-2016-9119)
Vulnerability from nvd – Published: 2017-01-30 22:00 – Updated: 2024-08-06 02:42
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/94501 | vdb-entryx_refsource_BID |
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
Date Public
2016-11-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:42:10.472Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-31T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9119",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "https://moinmo.in/SecurityFixes"
},
{
"name": "94501",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94501"
},
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9119",
"datePublished": "2017-01-30T22:00:00.000Z",
"dateReserved": "2016-10-30T00:00:00.000Z",
"dateUpdated": "2024-08-06T02:42:10.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7148 (GCVE-0-2016-7148)
Vulnerability from nvd – Published: 2016-11-10 17:00 – Updated: 2024-08-06 01:50
VLAI
EPSS
VEX
Summary
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile (via page name) component.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.securityfocus.com/bid/94259 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
| https://www.curesec.com/blog/article/blog/MoinMoi… | x_refsource_MISC |
Date Public
2016-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.471Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-30T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7148",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"name": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html",
"refsource": "MISC",
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7148",
"datePublished": "2016-11-10T17:00:00.000Z",
"dateReserved": "2016-09-05T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-7146 (GCVE-0-2016-7146)
Vulnerability from nvd – Published: 2016-11-10 17:00 – Updated: 2024-08-06 01:50
VLAI
EPSS
VEX
Summary
MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-3137-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.securityfocus.com/bid/94259 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2016/dsa-3715 | vendor-advisoryx_refsource_DEBIAN |
| https://www.curesec.com/blog/article/blog/MoinMoi… | x_refsource_MISC |
Date Public
2016-11-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:50:47.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation or crafted URL\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=fckdialog\u0026dialog=attachment (via page name) component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-30T21:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-3137-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7146",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation or crafted URL\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=fckdialog\u0026dialog=attachment (via page name) component."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-3137-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-3137-1"
},
{
"name": "94259",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94259"
},
{
"name": "DSA-3715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3715"
},
{
"name": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html",
"refsource": "MISC",
"url": "https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7146",
"datePublished": "2016-11-10T17:00:00.000Z",
"dateReserved": "2016-09-05T00:00:00.000Z",
"dateUpdated": "2024-08-06T01:50:47.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6495 (GCVE-0-2012-6495)
Vulnerability from nvd – Published: 2013-01-03 01:00 – Updated: 2024-09-16 23:26
VLAI
EPSS
VEX
Summary
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://www.openwall.com/lists/oss-security/2012/12/29/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2012/12/30/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:28:39.825Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6495",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"name": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1680-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6495",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2013-01-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:26:18.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6082 (GCVE-0-2012-6082)
Vulnerability from nvd – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://www.openwall.com/lists/oss-security/2012/12/30/5 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/rev/c98ec456e493 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/57089 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2012/12/29/7 | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/c98ec456e493"
},
{
"name": "57089",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57089"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/c98ec456e493"
},
{
"name": "57089",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57089"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (XSS in rss link)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6082",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6081 (GCVE-0-2012-6081)
Vulnerability from nvd – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://www.securityfocus.com/bid/57082 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2012/12/29/6 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51676 | third-party-advisoryx_refsource_SECUNIA |
| http://www.openwall.com/lists/oss-security/2012/12/30/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://www.exploit-db.com/exploits/25304 | exploitx_refsource_EXPLOIT-DB |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
Date Public
2012-12-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.522Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "57082",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57082"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51676"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "25304",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/25304"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-12-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-10T15:57:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "57082",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57082"
},
{
"name": "[oss-security] 20121229 CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/29/6"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51676"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (remote code execution vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/4"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "25304",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/25304"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6081",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-6080 (GCVE-0-2012-6080)
Vulnerability from nvd – Published: 2013-01-03 01:00 – Updated: 2024-08-06 21:21
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
10 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/57076 | vdb-entryx_refsource_BID |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://secunia.com/advisories/51663 | third-party-advisoryx_refsource_SECUNIA |
| http://www.debian.org/security/2012/dsa-2593 | vendor-advisoryx_refsource_DEBIAN |
| https://bugs.launchpad.net/ubuntu/+source/moin/+b… | x_refsource_MISC |
| http://secunia.com/advisories/51676 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52 | x_refsource_CONFIRM |
| http://secunia.com/advisories/51696 | third-party-advisoryx_refsource_SECUNIA |
| http://ubuntu.com/usn/usn-1680-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.openwall.com/lists/oss-security/2012/12/30/6 | mailing-listx_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "57076",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57076"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51676"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (path traversal vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-03T01:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "57076",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57076"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "51663",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51663"
},
{
"name": "DSA-2593",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2593"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599"
},
{
"name": "51676",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51676"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/3c27131a3c52"
},
{
"name": "51696",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51696"
},
{
"name": "USN-1680-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1680-1"
},
{
"name": "[oss-security] 20121229 Re: CVE request: MoinMoin Wiki (path traversal vulnerability)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/12/30/6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-6080",
"datePublished": "2013-01-03T01:00:00.000Z",
"dateReserved": "2012-12-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T21:21:28.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-4404 (GCVE-0-2012-4404)
Vulnerability from nvd – Published: 2012-09-10 22:00 – Updated: 2024-08-06 20:35
VLAI
EPSS
VEX
Summary
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
9 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-1604-1 | vendor-advisoryx_refsource_UBUNTU |
| http://secunia.com/advisories/50496 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.debian.org/security/2012/dsa-2538 | vendor-advisoryx_refsource_DEBIAN |
| http://www.openwall.com/lists/oss-security/2012/09/04/4 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/50885 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/50474 | third-party-advisoryx_refsource_SECUNIA |
| http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2012/09/05/2 | mailing-listx_refsource_MLIST |
Date Public
2012-09-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:35:09.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "50496",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50496"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2538",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2538"
},
{
"name": "[oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/04/4"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "50474",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50474"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16"
},
{
"name": "[oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/05/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-09-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as \"All,\" \"Known,\" or \"Trusted,\" which allows remote authenticated users with virtual group membership to be treated as a member of the group."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-10-30T09:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "50496",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50496"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2538",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2538"
},
{
"name": "[oss-security] 20120904 CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/04/4"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "50474",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50474"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16"
},
{
"name": "[oss-security] 20120904 Re: CVE request: moinmoin incorrect ACL evaluation for virtual groups",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/05/2"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-4404",
"datePublished": "2012-09-10T22:00:00.000Z",
"dateReserved": "2012-08-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T20:35:09.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-1058 (GCVE-0-2011-1058)
Vulnerability from nvd – Published: 2011-02-22 17:00 – Updated: 2024-08-06 22:14
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
14 references
Date Public
2011-02-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:27.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "46476",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "46476",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-1058",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "46476",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/46476"
},
{
"name": "USN-1604-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1604-1"
},
{
"name": "FEDORA-2011-2156",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "DSA-2321",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2321"
},
{
"name": "ADV-2011-0588",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0588"
},
{
"name": "FEDORA-2011-2157",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html"
},
{
"name": "43665",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43665"
},
{
"name": "50885",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50885"
},
{
"name": "ADV-2011-0455",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0455"
},
{
"name": "43413",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43413"
},
{
"name": "FEDORA-2011-2219",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html"
},
{
"name": "ADV-2011-0571",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0571"
},
{
"name": "moinmoin-refuri-xss(65545)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65545"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-1058",
"datePublished": "2011-02-22T17:00:00.000Z",
"dateReserved": "2011-02-21T00:00:00.000Z",
"dateUpdated": "2024-08-06T22:14:27.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2970 (GCVE-0-2010-2970)
Vulnerability from nvd – Published: 2010-08-04 21:00 – Updated: 2024-09-17 00:16
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2010/1981 | vdb-entryx_refsource_VUPEN |
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/40549 | vdb-entryx_refsource_BID |
| http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb | x_refsource_CONFIRM |
| http://www.debian.org/security/2010/dsa-2083 | vendor-advisoryx_refsource_DEBIAN |
| http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 | x_refsource_CONFIRM |
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 | x_refsource_CONFIRM |
| http://marc.info/?l=oss-security&m=127799369406968&w=2 | mailing-listx_refsource_MLIST |
| http://marc.info/?l=oss-security&m=127809682420259&w=2 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/… | x_refsource_CONFIRM |
| http://secunia.com/advisories/40836 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInput… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:45.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2970",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2010-1981",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/4fe9951788cb"
},
{
"name": "DSA-2083",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809",
"refsource": "CONFIRM",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"name": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "40836",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40836"
},
{
"name": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2970",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-08-04T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:31.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2969 (GCVE-0-2010-2969)
Vulnerability from nvd – Published: 2010-08-04 21:00 – Updated: 2024-09-16 20:38
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
13 references
| URL | Tags |
|---|---|
| http://www.vupen.com/english/advisories/2010/1981 | vdb-entryx_refsource_VUPEN |
| http://moinmo.in/MoinMoinRelease1.9 | x_refsource_CONFIRM |
| http://moinmo.in/SecurityFixes | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/40549 | vdb-entryx_refsource_BID |
| http://www.debian.org/security/2010/dsa-2083 | vendor-advisoryx_refsource_DEBIAN |
| http://hg.moinmo.in/moin/1.9/rev/e50b087c4572 | x_refsource_CONFIRM |
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809 | x_refsource_CONFIRM |
| http://marc.info/?l=oss-security&m=127799369406968&w=2 | mailing-listx_refsource_MLIST |
| http://marc.info/?l=oss-security&m=127809682420259&w=2 | mailing-listx_refsource_MLIST |
| http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/… | x_refsource_CONFIRM |
| http://hg.moinmo.in/moin/1.7/rev/37306fba2189 | x_refsource_CONFIRM |
| http://secunia.com/advisories/40836 | third-party-advisoryx_refsource_SECUNIA |
| http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInput… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:46.399Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2969",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2010-1981",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"name": "http://moinmo.in/MoinMoinRelease1.9",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"name": "http://moinmo.in/SecurityFixes",
"refsource": "CONFIRM",
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/40549"
},
{
"name": "DSA-2083",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"name": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809",
"refsource": "CONFIRM",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"name": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"name": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189",
"refsource": "CONFIRM",
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40836"
},
{
"name": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg",
"refsource": "CONFIRM",
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2969",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-08-04T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:38:11.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2487 (GCVE-0-2010-2487)
Vulnerability from nvd – Published: 2010-08-04 21:00 – Updated: 2024-08-07 02:32
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
17 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.844Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.8/rev/4238b0c90871"
},
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/68ba3cc79513"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinRelease1.8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-08-04T21:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.8/rev/4238b0c90871"
},
{
"name": "ADV-2010-1981",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1981"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/SecurityFixes"
},
{
"name": "40549",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/40549"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/68ba3cc79513"
},
{
"name": "DSA-2083",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2083"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/rev/e50b087c4572"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinRelease1.8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584809"
},
{
"name": "[oss-security] 20100701 CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127799369406968\u0026w=2"
},
{
"name": "[oss-security] 20100702 Re: CVE request: moin multiple XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=127809682420259\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.8/raw-file/1.8.8/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://hg.moinmo.in/moin/1.7/rev/37306fba2189"
},
{
"name": "40836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40836"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2487",
"datePublished": "2010-08-04T21:00:00.000Z",
"dateReserved": "2010-06-28T00:00:00.000Z",
"dateUpdated": "2024-08-07T02:32:16.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}