CVE-2024-47918 Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-47918 Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-47918

CVE-2024-47918 pertains to Tiki Wiki CMS Groupware, with publicly available details indicating a CWE-80 Basic XSS due to improper neutralization of script-related HTML tags in web pages, affecting versions before 28.0 (OpenVAS entry notes multiple vulnerabilities). Additional sources flag potenti...

Tiki wiki cms 跨站脚本漏洞

Tiki wiki cms is a website CMS. A cross-site scripting vulnerability exists in Tiki wiki cms versions prior to version 28, which stems from a cross-site scripting vulnerability due to an improper neutralization of inputs during page generation...

Tiki wiki cms 操作系统命令注入漏洞

Tiki wiki cms is a website CMS. An operating system command injection vulnerability exists in versions of Tiki Wiki CMS prior to version 28, which stems from an improper neutralization of special elements used in operating system commands, resulting in an operating system command injection...

PT-2024-32893 · Unknown · Tiki Wiki Cms

Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS affected versions not specified Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which can lead to basic XSS attacks. Additionally, there is a mention of improper...

PT-2024-32894 · Unknown · Tiki Wiki Cms

Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS versions prior to 28 Description: The issue is related to improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This occurs when the software does not properly handle special...

PT-2024-32896 · Unknown · Tiki Wiki Cms

Name of the Vulnerable Software and Affected Versions: Tiki Wiki CMS affected versions not specified Description: The issue is related to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS vulnerability. This vulnerability allows for the execution o...

Tiki wiki cms 操作系统命令注入漏洞

Tiki wiki cms is a website CMS. An operating system command injection vulnerability exists in versions of Tiki wiki cms prior to 28, which stems from improper input neutralization during page generation...

BIT-GITLAB-2024-10043 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

Vulnerabilities fixed in XWiki Platform

XWiki has fixed vulnerabilities in the XWiki Platform Specifically for versions 15.10.9 and 16.3.0. The vulnerabilities are in the way the XWiki Platform handles user permissions. A malicious user with programming privileges can execute code through the Extension Repository Application, or by...

Vulnerabilities fixed in GitLab

GitLab has fixed vulnerabilities in GitLab CE/EE Specifically for versions 11.0 to 17.6.2. The vulnerabilities are located in several versions of GitLab CE/EE and allow attackers to create groups with names that match existing unique domains, which can lead to domain confusion. In addition, users...

GHSA-CWQ6-MJMX-47P6 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

Impact Any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation e.g., Trigger on any job. If the operation is successful...

XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

Impact Any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation e.g., Trigger on any job. If the operation is successful...

CVE-2024-55876

CVE-2024-55876 affects XWiki Platform. Versions 1.2-milestone-2 through 16.3.0 are vulnerable: any account on the master wiki could execute scheduling operations on subwikis by interacting with Scheduler.WebHome and triggering a job, indicating an insufficient authorization boundary between main ...

CVE-2024-55876 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document...

CVE-2024-10043

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

UBUNTU-CVE-2024-10043

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

CVE-2024-10043 Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature,...

CVE-2024-10043

CVE-2024-10043 affects GitLab EE versions 14.3–before 17.4.6, 17.5–before 17.5.4, and 17.6–before 17.6.2. The issue allows group users to view confidential incident titles via the Wiki History Diff feature, leading to information disclosure. The documents indicate fixes in the applicable lines: u...