Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

moin

41 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
1.9.11 (Nov 8, 2020): affected by CVE-2008-6548
Newest unaffected release
Every release is affected by at least one advisory
Advisories
41 · 1 high
Weekly downloads
78
Dependents
1
Releases
22 since 1.8.4 (Oct 5, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 41 advisoriesShow fewer advisories
  • CVE-2010-2970
    Affects 1.9.0 to 1.9.2 (1.9.3 is outside it)
  • CVE-2010-2969
    Affects 1.9.0 to 1.9.2 (1.9.3 is outside it)
  • CVE-2010-2487
    Affects 1.8.4 to 1.9.2 (1.9.3 is outside it)
  • CVE-2010-0828
    Affects 1.8.4 to 1.9.2 (1.9.3 is outside it)
  • CVE-2009-4762
    No published release is affected
    No published release is affected
  • CVE-2010-0717
    Affects 1.8.4 to 1.8.6 (1.8.7 is outside it)
  • CVE-2010-0669
    Affects 1.8.4 to 1.8.6 (1.8.7 is outside it); 1.9.0 to 1.9.1 (1.9.2 is outside it)
  • CVE-2010-0668
    Affects 1.8.4 to 1.8.6 (1.8.7 is outside it); 1.9.0 to 1.9.1 (1.9.2 is outside it)
  • CVE-2010-0667
    Affects 1.9.0 (1.9.1 is outside it)
  • CVE-2009-1482
    No published release is affected
    No published release is affected
  • CVE-2008-6603
    No published release is affected
    No published release is affected
  • CVE-2008-6549
    No published release is affected
    No published release is affected
  • CVE-2008-6548
    Affects 1.8.4 to 2.0.0b5 (through the newest release)
  • CVE-2009-0312
    No published release is affected
    No published release is affected
  • CVE-2009-0260
    No published release is affected
    No published release is affected
  • CVE-2008-3381
    No published release is affected
    No published release is affected
  • CVE-2008-1937
    No published release is affected
    No published release is affected
  • CVE-2008-1099
    No published release is affected
    No published release is affected
  • CVE-2008-1098
    No published release is affected
    No published release is affected
  • CVE-2008-0782
    No published release is affected
    No published release is affected
  • CVE-2008-0781
    No published release is affected
    No published release is affected
  • CVE-2008-0780
    No published release is affected
    No published release is affected
  • CVE-2007-2637
    No published release is affected
    No published release is affected
  • CVE-2007-0902
    No published release is affected
    No published release is affected
  • CVE-2007-0901
    No published release is affected
    No published release is affected
  • CVE-2007-0857
    No published release is affected
    No published release is affected
  • CVE-2004-1463
    No published release is affected
    No published release is affected
  • CVE-2004-1462
    No published release is affected
    No published release is affected
  • CVE-2004-0708
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 41

  • malicious SVG attachment causing stored XSS vulnerability in MoinMoin

    Affected: fixed in 1.9.11.

    Fixed in 1.9.11 (released Nov 8, 2020, 3 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request.

    Affected: fixed in 1.9.11; fixed in 1.9.11.

    Fixed in 1.9.11 (released Nov 8, 2020, 2 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject…

    Affected: fixed in 1.9.10.

    Fixed in 1.9.10 (released Sep 9, 2018, 36 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject…

    Affected: fixed in 1.9.8.

    Fixed in 1.9.8 (released Oct 17, 2014, 836 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation" approach, related to a…

    Affected: fixed in 1.9.9.

    Fixed in 1.9.9 (released Oct 31, 2016, 10 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.9.8 allows remote attackers to conduct "JavaScript injection" attacks by using the "page creation or crafted URL" approach…

    Affected: from 1.9.8, fixed in 1.9.9; fixed in 1.9.9.

    Fixed in 1.9.9 (released Oct 31, 2016, 10 days before disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py)…

    Affected: fixed in 1.9.6.

    Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Cross-site scripting (XSS) vulnerability in the rsslink function in theme/init.py in MoinMoin 1.9.5 allows remote attackers to inject…

    Affected: fixed in 1.9.6.

    Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py)…

    Affected: fixed in 1.9.6.

    Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3…

    Affected: from 1.9.3, fixed in 1.9.6.

    Fixed in 1.9.6 (released Oct 5, 2015, 1005 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All,"…

    Affected: from 1.9, fixed in 1.9.5.

    Fixed in 1.9.5 (released Oct 5, 2015, 1120 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when…

    Affected: fixed in 1.9.3.

    Fixed in 1.9.3 (released Oct 5, 2015, 1686 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script…

    Affected: from 1.9, fixed in 1.9.3; from 1.9.0, fixed in 1.9.3.

    Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to…

    Affected: through 1.7.3; from 1.9.0, fixed in 1.9.3; from 1.9, fixed in 1.9.3.

    Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote…

    Affected: through 1.7.3; from 1.8.0, fixed in 1.8.8; from 1.9.0, fixed in 1.9.3; from 1.8, fixed in 1.8.8; from 1.9, fixed in 1.9.3.

    Fixed in 1.9.3 (released Oct 5, 2015, 1888 days after disclosure, the advisory names 1.8.8, which was never published).

    The latest release, 1.9.11, is not affected.

Show all 41 advisoriesShow fewer advisories

  • Cross-site scripting (XSS) vulnerability in action/Despam.py in the Despam action module in MoinMoin 1.8.7 and 1.9.2 allows remote…

    Affected: fixed in 1.9.3; from 1.9.0, fixed in 1.9.3; from 1.8.0, fixed in 1.8.8.

    Fixed in 1.9.3 (released Oct 5, 2015, 2009 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of…

    Affected: from 1.7.0, fixed in 1.7.3; from 1.8.0, fixed in 1.8.3; from 1.7, fixed in 1.7.3; from 1.8, fixed in 1.8.3.

    Fixed in 1.8.4 (released Oct 5, 2015, 2016 days after disclosure, the advisory names 1.7.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has…

    Affected: fixed in 1.8.7.

    Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.

    Affected: fixed in 1.8.7; from 1.9, fixed in 1.9.2; fixed in 1.8.7; from 1.9, fixed in 1.9.2.

    Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure) and 1.9.2 (released Oct 5, 2015, 2047 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack…

    Affected: from 1.5, fixed in 1.8.7; from 1.9, fixed in 1.9.2; from 1.8, fixed in 1.8.7; from 1.9, fixed in 1.9.2.

    Fixed in 1.8.7 (released Oct 5, 2015, 2047 days after disclosure) and 1.9.2 (released Oct 5, 2015, 2047 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE…

    Affected: from 1.9, fixed in 1.9.1.

    Fixed in 1.9.1 (released Oct 5, 2015, 2047 days after disclosure).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject…

    Affected: fixed in 1.8.3.

    Fixed in 1.8.4 (released Oct 5, 2015, 2350 days after disclosure, the advisory names 1.8.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to…

    Affected: fixed in 1.6.3; from 1.7, fixed in 1.7.1; fixed in 1.6.3; from 1.7, fixed in 1.7.1.

    Fixed in 1.8.4 (released Oct 5, 2015, 2376 days after disclosure, the advisory names 1.6.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are…

    Affected: fixed in 1.6.1.

    Fixed in 1.8.4 (released Oct 5, 2015, 2380 days after disclosure, the advisory names 1.6.1, which was never published).

    The latest release, 1.9.11, is not affected.

  • The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read…

    Affected: all versions; fixed in 1.6.2.

    No fix released. The latest release, 1.9.11, is still affected.

  • Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers…

    Affected: fixed in 1.8.2.

    Fixed in 1.8.4 (released Oct 5, 2015, 2441 days after disclosure, the advisory names 1.8.2, which was never published).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject…

    Affected: fixed in 1.8.1.

    Fixed in 1.8.4 (released Oct 5, 2015, 2446 days after disclosure, the advisory names 1.8.1, which was never published).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in macro/AdvancedSearch.py in moin (and MoinMoin) 1.6.3 and 1.7.0 allow remote…

    Affected: fixed in 1.6.4; from 1.7.0, fixed in 1.7.1; fixed in 1.6.4; from 1.7.0, fixed in 1.7.1.

    Fixed in 1.8.4 (released Oct 5, 2015, 2623 days after disclosure, the advisory names 1.6.4, which was never published).

    The latest release, 1.9.11, is not affected.

  • The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage…

    Affected: fixed in 1.6.3; from 1.7, fixed in 1.7.1; fixed in 1.6.3.

    Fixed in 1.8.4 (released Oct 5, 2015, 2720 days after disclosure, the advisory names 1.6.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • _macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read…

    Affected: through 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 2770 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or…

    Affected: through 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 2770 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.9.11, is not affected.

  • Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a ..

    Affected: through 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject…

    Affected: through 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.9.11, is not affected.

  • Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject…

    Affected: from 1.5, through 1.5.8; from 1.6, fixed in 1.6.1; from 1.5, fixed in 1.6.1.

    Fixed in 1.8.4 (released Oct 5, 2015, 2790 days after disclosure, the advisory names 1.6.1, which was never published).

    The latest release, 1.9.11, is not affected.

  • MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages…

    Affected: fixed in 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 3067 days after disclosure, the advisory names 1.5.8, which was never published).

    The latest release, 1.9.11, is not affected.

  • Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive…

    Affected: from 1.5.7, fixed in 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 3156 days after disclosure, the advisory names 1.5.8, which was never published).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script…

    Affected: fixed in 1.5.8.

    Fixed in 1.8.4 (released Oct 5, 2015, 3156 days after disclosure, the advisory names 1.5.8, which was never published).

    The latest release, 1.9.11, is not affected.

  • Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML…

    Affected: fixed in 1.5.7.

    Fixed in 1.8.4 (released Oct 5, 2015, 3161 days after disclosure, the advisory names 1.5.7, which was never published).

    The latest release, 1.9.11, is not affected.

  • Unknown vulnerability in the PageEditor in MoinMoin 1.2.2 and earlier, related to Access Control Lists (ACL), has unknown impact.

    Affected: fixed in 1.2.3.

    Fixed in 1.8.4 (released Oct 5, 2015, 3886 days after disclosure, the advisory names 1.2.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as…

    Affected: fixed in 1.2.3.

    Fixed in 1.8.4 (released Oct 5, 2015, 3886 days after disclosure, the advisory names 1.2.3, which was never published).

    The latest release, 1.9.11, is not affected.

  • MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has…

    Affected: fixed in 1.2.2.

    Fixed in 1.8.4 (released Oct 5, 2015, 4093 days after disclosure, the advisory names 1.2.2, which was never published).

    The latest release, 1.9.11, is not affected.