Tiki Tiki Wiki CMS/Groupware 16.2

CPE Details

Tiki Tiki Wiki CMS/Groupware 16.2
tiki
tikiwiki_cms\/groupware
16.2
2019-10-23
18h34 +00:00
2019-10-23
18h34 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:tiki:tikiwiki_cms\/groupware:16.2:*:*:*:*:*:*:*

Informations

Vendor

tiki

Product

tikiwiki_cms\/groupware

Version

16.2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-8966 2020-04-01 20h18 +00:00 There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.
6.5
Medium
CVE-2018-20719 2019-01-15 15h00 +00:00 In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
8.8
High
CVE-2018-7188 2018-02-16 18h00 +00:00 An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php.
5.4
Medium
CVE-2017-14924 2017-09-29 05h00 +00:00 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
8
High
CVE-2017-14925 2017-09-29 05h00 +00:00 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.
8
High
CVE-2017-9145 2017-06-26 11h00 +00:00 TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
6.1
Medium
CVE-2017-9305 2017-05-31 01h54 +00:00 lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters, as demonstrated by an attack on tiki-batch_send_newsletter.php.
6.1
Medium