Media

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote atta

Publicada: 22.02.2011
Actualizado: 11.10.2026 12:20

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	moin	< 1.9.3	1.9.3

Referencias

Puntuación CVSS 6.1/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: moin
Publicada: 22.02.2011
Actualizado: 11.10.2026 12:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m9j7-xcj7-42j9 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2011-6 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: moin

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (41) en el archivo

Entradas en total: 41
Primera → última: 04.2008 05.2022
Sin corrección: 5
Explotada en ataques: 0

Distribución por gravedad

Alta 11
Media 30

Divulgaciones por año

2017: 1
2018: 1
2019: 0
2020: 2
2021: 0
2022: 14
2023: 0
2024: 0
2025: 0
2026: 0

antes: 23

29.04.2022

MoinMoin Improper Privilege Management

Alta CVE-2004-1463 < 1.2.3 1.2.3
29.04.2022

MoinMoin Improper Access Control

Alta CVE-2004-1462 < 1.2.3 1.2.3
29.04.2022

MoinMoin allows administrative access

Alta CVE-2004-0708 < 1.2.2 1.2.2
10.11.2020

MoinMoin vulnerable to remote code execution via cache action

Alta · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
22.02.2011

Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote atta esta entrada

Media · 6.1 CVE-2011-1058 < 1.9.3 1.9.3
29.03.2010

MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac

Alta · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
26.02.2010

MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

Alta CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
26.02.2010

The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.

Alta CVE-2010-0717 < 1.8.7 1.8.7
26.02.2010

MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se

Alta · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
03.04.2009

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha

Alta · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
30.03.2009

MoinMoin Denial of Service vulnerability via password_checker function

Alta · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
25.04.2008

The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.

Alta · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación