Two vulnerabilities have been identified in TWiki, which could be exploited by attackers to gain knowledge of sensitive information or compromise a vulnerable web server.
The first issue is caused by an input validation error when processing the "SEARCH" parameter via an "eval()" call, which could allow remote attackers to inject and execute arbitrary commands.
The second vulnerability is caused by an input validation error when processing the "URLPARAM" parameter, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected site.
