Moinmoin

CVE-2012-6081 Jan 03, 01:55 PyPI MEDIUM POC PATCH THREAT This Month

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 73.6%.

CVE-2020-15275 Nov 11, 16:15 PyPI MEDIUM POC PATCH This Month

MoinMoin is a wiki engine. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2020-25074 Nov 10, 17:15 PyPI CRITICAL PATCH Act Now

The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2016-9119 Jan 30, 22:59 PyPI MEDIUM PATCH This Month

Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-7148 Nov 10, 17:59 PyPI MEDIUM POC PATCH This Month

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=AttachFile. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2016-7146 Nov 10, 17:59 PyPI MEDIUM POC PATCH This Month

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2012-6495 Jan 03, 01:55 PyPI MEDIUM POC PATCH This Month

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-6082 Jan 03, 01:55 PyPI MEDIUM POC PATCH This Month

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-6080 Jan 03, 01:55 PyPI MEDIUM PATCH This Month

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2012-4404 Sep 10, 22:55 PyPI MEDIUM PATCH This Month

security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable.