CVE-2021-47711

Kentico Xperience SQL Injection (CVE-2021-47711) affects Online Marketing Macro Method inputs in Kentico Xperience libraries. The root cause is lack of validation for externally entered SQL in macro method parameters (e.g., DidActivity/whereCondition), enabling authenticated editors to inject mal...

CVE-2020-36890 Kentico Xperience <= 10 Administrator Access Control Bypass

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege...

CLSA-2025-1765824979 go-rpm-macros: Fix of CVE-2025-47906

Rebuild with golang = 1.22.9-1.el92.tuxcare.els2 to address CVE-2025-47906...

CVE-2025-66474

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

CVE-2025-66474 XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

GHSA-9XC6-C2RM-F27P XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign

The Iranian hacking group known as MuddyWater has been observed leveraging a new backdoor dubbed UDPGangster that uses the User Datagram Protocol UDP for command-and-control C2 purposes. The cyber espionage activity targeted users in Turkey, Israel, and Azerbaijan, according to a report from...

CVE-2025-65036

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

CVE-2025-65036

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

CVE-2025-65036

XWiki Remote Macros (xwiki-pro-macros) prior to version 1.27.1 allow remote code execution by executing Velocity from details pages without proper permission checks. Affected component is the macro rendering feature used for Confluence content migration. The issue is fixed in 1.27.1; remediation ...

CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

EUVD-2025-201417

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1...

[SECURITY] Fedora 42 Update: texlive-base-20230311-94.fc42

The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font...

xwiki-pro-macros 安全漏洞

xwiki-pro-macros is an open source tool from XWiki SAS. It can enhance the functionality of XWiki. A security vulnerability exists in xwiki-pro-macros versions prior to 1.27.1, which stems from unchecked privileges to execute Velocity, and could lead to remote code execution...

PT-2025-49257

Name of the Vulnerable Software and Affected Versions XWiki Remote Macros versions prior to 1.27.1 Description XWiki Remote Macros includes XWiki rendering macros designed for content migration from Confluence. Versions of the software prior to 1.27.1 execute Velocity code from details pages...

Fedora 43 : python-kdcproxy (2025-3f9b87b0e7)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3f9b87b0e7 advisory. - New upstream version 1.1.0 - Use DNS discovery for declared realms only CVE-2025-59088 - Fix DoS vulnerability based on unbounded TCP buffering...

[SECURITY] Fedora 43 Update: kf6-kcoreaddons-6.20.0-2.fc43

KCoreAddons provides classes built on top of QtCore to perform various tasks such as manipulating mime types, autosaving files, creating backup files, generating random sequences, performing text manipulations such as macro replacement, accessing user information and many more...