Tiki Tikiwiki Cms/groupware 12.5 Lts Edition

CPE Details

Tiki Tikiwiki Cms/groupware 12.5 Lts Edition
tiki
tikiwiki_cms\/groupware
12.5
2019-10-23
18h34 +00:00
2019-10-23
18h34 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:tiki:tikiwiki_cms\/groupware:12.5:*:*:*:lts:*:*:*

Informations

Vendor

tiki

Product

tikiwiki_cms\/groupware

Version

12.5

Software Edition

lts

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2020-8966 2020-04-01 20h18 +00:00 There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.
6.5
Moyen
CVE-2018-20719 2019-01-15 15h00 +00:00 In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
8.8
Haute
CVE-2018-14849 2018-08-13 15h00 +00:00 Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
5.4
Moyen
CVE-2018-14850 2018-08-13 15h00 +00:00 Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.
5.4
Moyen
CVE-2018-7290 2018-03-09 19h00 +00:00 Cross Site Scripting (XSS) exists in Tiki before 12.13, 15.6, 17.2, and 18.1.
5.4
Moyen
CVE-2018-7188 2018-02-16 18h00 +00:00 An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image, related to lib/filegals/filegallib.php.
5.4
Moyen
CVE-2016-7394 2018-02-06 15h00 +00:00 tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.
6.1
Moyen
CVE-2017-14924 2017-09-29 05h00 +00:00 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with an IMG element, related to tiki-assignuser.php.
8
Haute
CVE-2017-14925 2017-09-29 05h00 +00:00 Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 LTS before 12.12 LTS, and 15 LTS before 15.5 LTS allows an authenticated user to edit global permissions if an administrator opens a wiki page with an IMG element, related to tiki-objectpermissions.php. For example, an attacker could assign administrator privileges to every unauthenticated user of the site.
8
Haute
CVE-2017-9145 2017-06-26 11h00 +00:00 TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
6.1
Moyen
CVE-2016-9889 2016-12-23 04h00 +00:00 Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.
6.1
Moyen