CVE-2023-29520

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This will lead to a broken page. The vulnerability has been...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can ...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page e.g., it's own user page, can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A comment with either macro will be execut...

AIX (IJ45981)

The version of AIX installed on the remote host is prior to APAR IJ45981. It is, therefore, affected by a vulnerability as referenced in the IJ45981 advisory. - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX runtime services libra...

AIX is vulnerable to arbitrary command execution

IBM SECURITY ADVISORY First Issued: Wed Apr 12 12:36:51 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/librtsadvisory.asc Security Bulletin: AIX is vulnerable to arbitrary command execution CVE-2023-26286...

PT-2023-2525 · Ibm · Vios +1

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.1 through 7.3 VIOS version 3.1 Description: The issue allows a non-privileged local user to exploit a vulnerability in the AIX runtime services library, specifically due to the lack of neutralization of special elements use...

PT-2023-9334

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a NULL pointer dereference in the EFI initialization error path. When runtime services are not supported or have been disabled, the runtime services workqueue is...

CVE-2022-41932

Summary: CVE-2022-41932 affects XWiki Platform and allows an attacker to trigger creation of many new schemas and tables by supplying a crafted user identifier in the login form, causing degraded database performance. The underlying issue is a design/logic flaw that enables uncontrolled resource ...

PT-2025-8291

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, which occurred on Apple T2 Macs when attempting to read the db and dbx efi variables at early boot to load UEFI Secure Boot...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1...

CVE-2022-24819 Unauthenticated user can retrieve the list of users through uorgsuggest.vm

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1...

PT-2022-28879

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.16.5 Description The issue concerns the use of EFIv2 runtime services on Apple x86 machines. It is noted that the actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

GSD-2022-1000243 efi: runtime: avoid EFIv2 runtime services on Apple x86 machines

efi: runtime: avoid EFIv2 runtime services on Apple x86 machines This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.19 by commit...

PT-2022-28462

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.10.96 Description The issue concerns avoiding EFIv2 runtime services on Apple x86 machines. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-28521

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.15.19 Description The issue concerns avoiding EFIv2 runtime services on Apple x86 machines. The actual impact and attack plausibility have not yet been proven. Recommendations For versions prior to 5.15.19,...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23621

CVE-2022-23621 – XWiki Platform is affected where any user with SCRIPT rights can read arbitrary files from the XWiki WAR (for example xwiki.cfg) via XWiki#invokeServletAndReturnAsString (using "/WEB-INF/xwiki.cfg"). The issue is fixed in XWiki versions 12.10.9, 13.4.3, and 13.7-rc-1. The vulnera...