CVE-2014-7236 | Critical | 9.1 | 2020-02-17 | Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins pa… |
CVE-2013-1751 | Critical | 9.8 | 2019-11-07 | TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' parameter value containing Perl backtick cha… |
CVE-2005-3056 | Critical | 9.8 | 2019-11-01 | TWiki allows arbitrary shell command execution via the Include function |
CVE-2018-20212 | Medium | 6.1 | 2019-03-21 | bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter. |
CVE-2014-9367 | | | 2014-12-31 | Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (… |
CVE-2014-9325 | | | 2014-12-31 | Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variab… |
CVE-2014-7237 | | | 2014-10-16 | lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with… |
CVE-2012-6330 | | | 2013-01-04 | The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of se… |
CVE-2012-0979 | | | 2012-02-02 | Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, invol… |
CVE-2011-3010 | | | 2011-09-30 | Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic pa… |
CVE-2011-1838 | | | 2011-05-20 | Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2010-3841 | | | 2010-10-18 | Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1)… |
CVE-2009-4898 | | | 2010-09-07 | Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 allows remote attackers to hijack the authentication of arbitrary users for requests that… |
CVE-2009-1339 | | | 2009-04-30 | Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for req… |
CVE-2008-5305 | | | 2008-12-10 | Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. |
CVE-2008-5304 | | | 2008-12-10 | Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable. |
CVE-2008-4998 | | | 2008-11-07 | postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/twiki temporary file. NOTE: the vendor disputes this… |
CVE-2008-3195 | | | 2008-09-18 | Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to… |
CVE-2007-5193 | | | 2007-10-04 | The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory (cfg{RCS}{WorkAreaDir})… |
CVE-2007-0669 | | | 2007-02-08 | Unspecified vulnerability in Twiki 4.0.0 through 4.1.0 allows local users to execute arbitrary Perl code via unknown vectors related to CGI session files. |
CVE-2006-6071 | | | 2006-12-02 | TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not proper… |
CVE-2006-4294 | | | 2006-09-09 | Directory traversal vulnerability in viewfile in TWiki 4.0.0 through 4.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename p… |
CVE-2006-3819 | | | 2006-07-27 | Eval injection vulnerability in the configure script in TWiki 4.0.0 through 4.0.4 allows remote attackers to execute arbitrary Perl code via an HTTP POST reque… |
CVE-2006-3336 | | | 2006-07-05 | TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php… |
CVE-2006-2942 | | | 2006-06-20 | TWiki 4.0.0, 4.0.1, and 4.0.2 allows remote attackers to gain Twiki administrator privileges via a TWiki.TWikiRegistration form with a modified action attribut… |
CVE-2006-1387 | | | 2006-03-26 | TWiki 4.0, 4.0.1, and 20010901 through 20040904 allows remote authenticated users with edit rights to cause a denial of service (infinite recursion leading to… |
CVE-2006-1386 | | | 2006-03-26 | The (1) rdiff and (2) preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, which allows remote attackers to read restricted areas and access… |
CVE-2005-2877 | | | 2005-09-16 | The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonst… |
CVE-2004-1037 | | | 2005-03-01 | The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string. |
CVE-2005-0516 | | | 2005-02-23 | The ImageGalleryPlugin (ImageGalleryPlugin.pm) in Twiki allows remote attackers to execute arbitrary commands via certain commands that generate thumbnails. |