Silverpeas Security Vulnerabilities

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the Create a Space feature for administrators only,...

Silverpeas Security Vulnerabilities

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the vulnerability of the Bin feature to corrupted acce...

CVE-2023-47320

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. An attacker with low privileges is able to execute the administrator-only function of putting the application in "Maintenance Mode" due to broken access control. This makes the application unavailable to all users. This affects...

CVE-2023-47327

The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. This function suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL...

PT-2023-30417

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 and prior Description The issue is related to Cross Site Scripting XSS via the message/notification feature. This allows for potential malicious script execution. No information is provided about the estimated...

Silverpeas Cross-Site Request Forgery Vulnerability

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums, and document management. A cross-site request forgery vulnerability exists in Silverpeas Core version 6.3.1, which stems from a CSRF that could be executed if an...

PT-2023-30414

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The issue is related to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. Recommendations For Silverpeas Core version 6.3.1, consider restricting...

CVE-2023-47324

CVE-2023-47324 affects Silverpeas Core 6.3.1 (and older) with a Cross-Site Scripting (XSS) vulnerability exposed via the message/notification feature. The issue is documented across multiple feeds (NVD, Red Hat CVE, GHSA, OSV, CNVD, CVE listing) with consistent description; no explicit root-cause...

PT-2023-30416

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The notification/messaging feature does not enforce access control on the ID parameter. This allows an attacker to read all messages sent between other users, including those sent only to administrator...

PT-2023-30418

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The administrative "Bin" feature in Silverpeas Core is affected by broken access control, allowing a user with low privileges to navigate directly to the bin. This reveals all deleted spaces, which the...

CVE-2023-47324

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting XSS via the message/notification feature...

Silverpeas Cross-Site Scripting Vulnerability

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A cross-site scripting vulnerability exists in Silverpeas Core version 6.3.1, which stems from vulnerability to cross-site scripting XSS...

Silverpeas Cross-Site Request Forgery Vulnerability

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A cross-site request forgery vulnerability exists in Silverpeas Core version 6.3.1, which stems from the domain SQL creation feature bein...

CVE-2023-47322

CVE-2023-47322 — Silverpeas Core 6.3.1 CSRF leads to privilege escalation. The vulnerability is a CSRF in the userModify feature that, when an authenticated administrator visits a malicious URL, can elevate the attacker to administrator status within the Silverpeas application. Primary sources (N...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

WP 5.6-6.3.1 - Contributor+ Stored XSS via Navigation Block

Description WordPress does not escape some of its Navigation block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Multiple Vulnerabilities (Oct 2023) - Linux

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

PT-2023-26245 · WordPress · Gutenberg +1

Name of the Vulnerable Software and Affected Versions: WordPress core versions 5.9 through 5.9.7 WordPress core versions 6.0 through 6.0.5 WordPress core versions 6.1 through 6.1.3 WordPress core versions 6.2 through 6.2.2 WordPress core versions 6.3 through 6.3.1 Gutenberg plugin versions = 16.8...

WordPress is vulnerable to Cross Site Scripting (XSS)

Software WordPress Type WordPress Core Vulnerable versions 6.3-6.3.1 Fixed in 6.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b089176efe9a Credits Jorge Costa Required privilege Contributor...

Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection

Description The plugin unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog. To simulate a gadget chain, put the following code in a plugin: class Test...