CVE-2023-29203

CVE-2023-29203 concerns XWiki Commons and an information-disclosure vulnerability where an attacker could list hidden main-wiki users by requesting subwiki users via uorgsuggest.vm. Affected component: XWiki Commons (library used by multiple XWiki projects); vulnerability type: information disclo...

CVE-2023-29202

CVE-2023-29202 affects XWiki Commons and is caused by the RSS macro emitting feed item HTML without cleaning when content=true, enabling XSS (and potential privilege escalation/remote actions) under a user with programming rights. The vulnerability is addressed in XWiki 14.6 RC1, where feed conte...

XWiki Commons 代码注入漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user with view access to normally accessible documentation, including notification preference macros, can execute arbitrary Groovy...

XWiki Commons 安全漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. There is a security vulnerability in XWiki Commons, which stems from the fact that it is possible to list users that are not normally viewable from the subwiki by requesting the users on the subwiki, which is only...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from the fact that when the parameter content is set to true, the RSS macro bundled with XWiki contains the content of feed items without any...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from Livetable Macro not properly cleaning up column names, thus allowing the insertion of raw HTML code including JavaScript...

XWiki Commons 代码注入漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user with view permissions to normally accessible documents, including legacy notification activity macros, can execute arbitrary...

XWiki Commons 安全漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that once a document has been deleted, the permissions added to the document are not taken into account for viewing it...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from the fact that the HTML macro does not properly neutralize html tags related to scripts...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top-level XWiki projects of the XWiki Foundation in France. A cross-site scripting vulnerability exists in XWiki Commons version 4.2-milestone-1, which stems from Not escaping attributes that can be used to inject scripts, and not...

XWiki Commons 输入验证错误漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. An input validation error vulnerability exists in XWiki Commons, which stems from an existing security measure implemented to avoid open redirects by using a special URL...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-24998)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to Apache Commons FileUpload - CVE-2023-24998

Summary IBM WebSphere Application Server Liberty is vulnerable to a denial of service due to Apache Commons FileUpload . Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin: Jazz Foundation, IBM Engineering Workflow...

Security Bulletin: AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient (CVE-2012-5783)

Summary A vulnerability in Apache Commons HttpClient could allow a remote attacker to conduct spoofing attacks CVE-2012-5783. AIX ships Apache Commons HttpClient as part of Electronic Customer Care. Vulnerability Details CVEID:CVE-2012-5783 DESCRIPTION: Apache Commons HttpClient, as used in Amazo...

AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient

IBM SECURITY ADVISORY First Issued: Thu Apr 13 13:44:57 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/commonshttpadvisory.asc Security Bulletin: AIX is vulnerable to an SSL server spoof due to Apache Commons HttpClient...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty profile shipped with IBM Business Automation Workflow (CVE-2023-24998)

Summary WebSphere Application Server traditional and WebSphere Application Server Liberty profile are shipped as a component of IBM Business Automation Workflow. Information about a security vulnerability affecting IBM WebSphere Application Server Traditional and Liberty profile have been publish...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI (CVE-2023-24998)

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2023-1612)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Juniper JunOS

Juniper has fixed vulnerabilities in JunOS. A malicious person can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Remote code execution Administrator/Root rights Remote code execution...

The vulnerability of the Apache Commons FileUpload library, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the Apache Commons FileUpload library is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...