FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
4c017345-1d89-11e0-bbee-0014a5e3cda6MoinMoin -- cross-site scripting vulnerabilities

The MoinMoin developers reports:

Fix XSS in Despam action (CVE-2010-0828)

Fix XSS issues

  • by escaping template name in messages
  • by fixing other places that had similar issues

Discovery 2010-04-05
Entry 2011-01-11
moinmoin
< 1.9.3

39110
CVE-2010-0828
http://hg.moinmo.in/moin/1.9/raw-file/1.9.3/docs/CHANGES
http://moinmo.in/MoinMoinBugs/1.9.2UnescapedInputForThemeAddMsg
ab804e60-d693-11e6-9171-14dae9d210b8moinmoin -- XSS vulnerabilities

Thomas Waldmann reports:

  • fix XSS in AttachFile view (multifile related) CVE-2016-7148

  • fix XSS in GUI editor's attachment dialogue CVE-2016-7146

  • fix XSS in GUI editor's link dialogue CVE-2016-9119


Discovery 2016-10-31
Entry 2017-01-09
moinmoin
< 1.9.9

http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES
CVE-2016-7148
CVE-2016-7146
CVE-2016-9119
ports/214937
fc4d0ae8-3fa3-11de-a3fd-0030843d3802moinmoin -- multiple cross site scripting vulnerabilities

Secunia reports:

Some vulnerabilities have been reported in MoinMoin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.


Discovery 2009-01-21
Entry 2009-05-13
moinmoin
< 1.8.2

CVE-2009-0260
CVE-2009-0312
http://moinmo.in/SecurityFixes
http://secunia.com/advisories/33593
4a8a98ab-f745-11e1-8bd8-0022156e8794moinmoin -- cross-site scripting via RST parser

MITRE CVE team reports:

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.4, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.


Discovery 2011-02-21
Entry 2012-09-05
moinmoin
< 1.9.4

46476
CVE-2011-1058
http://moinmo.in/SecurityFixes
abed4ff0-7da1-4236-880d-de33e4895315moinmoin -- multiple vulnerabilities

MoinMoin reports:

  • Security fix for CVE-2020-25074: fix remote code execution via cache action

  • Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability


Discovery 2020-11-08
Entry 2021-01-18
moinmoin
< 1.9.11

https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13
CVE-2020-25074
CVE-2020-15275
bfe218a5-4218-11de-b67a-0030843d3802moinmoin -- cross-site scripting vulnerabilities

Secunia reports:

Input passed via multiple parameters to action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.


Discovery 2009-04-21
Entry 2009-05-16
moinmoin
< 1.8.3

CVE-2009-1482
http://secunia.com/advisories/34821/
http://moinmo.in/SecurityFixes
a264b1b0-5726-11e2-9483-14dae938ec40moinmoin -- Multiple vulnerabilities

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6:

  • remote code execution vulnerability in twikidraw/anywikidraw action,
  • path traversal vulnerability in AttachFile action,
  • XSS issue, escape page name in rss link.

CVE entries at MITRE furher clarify:

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.


Discovery 2012-12-29
Entry 2013-01-05
Modified 2013-01-06
moinmoin
< 1.9.6

CVE-2012-6081
CVE-2012-6080
CVE-2012-6082
http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES
http://www.debian.org/security/2012/dsa-2593
6a523dba-eeab-11dd-ab4f-0030843d3802moinmoin -- multiple cross site scripting vulnerabilities

Secunia reports:

Input passed to multiple parameters in action/AttachFile.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.

Certain input passed to security/antispam.py is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.


Discovery 2009-01-21
Entry 2009-01-30
moinmoin
< 1.8.1

CVE-2009-0260
CVE-2009-0312
http://secunia.com/advisories/33593/
http://hg.moinmo.in/moin/1.8/file/c76d50dac855
http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad
http://moinmo.in/SecurityFixes#moin1.8.1