FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
ab804e60-d693-11e6-9171-14dae9d210b8moinmoin -- XSS vulnerabilities

Thomas Waldmann reports:

  • fix XSS in AttachFile view (multifile related) CVE-2016-7148

  • fix XSS in GUI editor's attachment dialogue CVE-2016-7146

  • fix XSS in GUI editor's link dialogue CVE-2016-9119


Discovery 2016-10-31
Entry 2017-01-09
moinmoin
< 1.9.9

http://hg.moinmo.in/moin/1.9/file/1.9.9/docs/CHANGES
CVE-2016-7148
CVE-2016-7146
CVE-2016-9119
ports/214937
abed4ff0-7da1-4236-880d-de33e4895315moinmoin -- multiple vulnerabilities

MoinMoin reports:

  • Security fix for CVE-2020-25074: fix remote code execution via cache action

  • Security fix for CVE-2020-15275: fix malicious SVG attachment causing stored XSS vulnerability


Discovery 2020-11-08
Entry 2021-01-18
moinmoin
< 1.9.11

https://github.com/moinwiki/moin-1.9/blob/1.9.11/docs/CHANGES#L13
CVE-2020-25074
CVE-2020-15275
a264b1b0-5726-11e2-9483-14dae938ec40moinmoin -- Multiple vulnerabilities

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6:

  • remote code execution vulnerability in twikidraw/anywikidraw action,
  • path traversal vulnerability in AttachFile action,
  • XSS issue, escape page name in rss link.

CVE entries at MITRE furher clarify:

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.


Discovery 2012-12-29
Entry 2013-01-05
Modified 2013-01-06
moinmoin
< 1.9.6

CVE-2012-6081
CVE-2012-6080
CVE-2012-6082
http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES
http://www.debian.org/security/2012/dsa-2593