Media

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the act

Publicada: 10.11.2016
Actualizado: 11.10.2026 12:20

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the action=fckdialog&dialog=attachment (via page name) component.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	moin	< 1.9.9	1.9.9

Referencias

Puntuación CVSS 6.1/10

Vector CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: moin
Publicada: 10.11.2016
Actualizado: 11.10.2026 12:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-fj26-q4vh-85f6 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2016-30 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: moin

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (41) en el archivo

Entradas en total: 41
Primera → última: 04.2008 05.2022
Sin corrección: 5
Explotada en ataques: 0

Distribución por gravedad

Alta 11
Media 30

Divulgaciones por año

2017: 1
2018: 1
2019: 0
2020: 2
2021: 0
2022: 14
2023: 0
2024: 0
2025: 0
2026: 0

antes: 23

29.04.2022

MoinMoin Improper Privilege Management

Alta CVE-2004-1463 < 1.2.3 1.2.3
29.04.2022

MoinMoin Improper Access Control

Alta CVE-2004-1462 < 1.2.3 1.2.3
29.04.2022

MoinMoin allows administrative access

Alta CVE-2004-0708 < 1.2.2 1.2.2
10.11.2020

MoinMoin vulnerable to remote code execution via cache action

Alta · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
10.11.2016

MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach, related to a "Cross Site Scripting (XSS)" issue affecting the act esta entrada

Media · 6.1 CVE-2016-7146 < 1.9.9 1.9.9
29.03.2010

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac

Alta · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
26.02.2010

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

Alta CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
26.02.2010

The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

Alta CVE-2010-0717 < 1.8.7 1.8.7
26.02.2010

MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se

Alta · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
03.04.2009

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha

Alta · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
30.03.2009

MoinMoin Denial of Service vulnerability via password_checker function

Alta · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
25.04.2008

The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

Alta · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación