https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:06:39 +0000 https://cve.radiocsirt.org/vuln/cve-2020-15275 <p><strong>Affected:</strong> moinwiki moin-1.9</p> <p>MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user&#39;s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> <p><strong>Affected:</strong> moinwiki moin-1.9</p> <p>MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user&#39;s browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> https://cve.radiocsirt.org/vuln/cve-2020-15275 https://cve.radiocsirt.org/vuln/ghsa-4q96-6xhq-ff43 <p><strong>Affected:</strong> PyPI: moin</p> <p>### Impact An attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user&#39;s browser when the user is viewing that SVG file on the wiki.</p> <p>### Patches Users are strongly advised to upgrade to a patched version.</p> <p>MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> <p>### Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.</p> <p>That said, a work around via a Content Security Policy in the web server might be possible.</p> <p>Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.</p> <p>### For more information If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).</p> <p>### Credits</p> <p>This vulnerability was discovered by:</p> <p>Catarina Leite from the Checkmarx SCA AppSec team</p> <p><strong>Affected:</strong> PyPI: moin</p> <p>### Impact An attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user&#39;s browser when the user is viewing that SVG file on the wiki.</p> <p>### Patches Users are strongly advised to upgrade to a patched version.</p> <p>MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> <p>### Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.</p> <p>That said, a work around via a Content Security Policy in the web server might be possible.</p> <p>Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.</p> <p>### For more information If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).</p> <p>### Credits</p> <p>This vulnerability was discovered by:</p> <p>Catarina Leite from the Checkmarx SCA AppSec team</p> https://cve.radiocsirt.org/vuln/ghsa-4q96-6xhq-ff43