Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

CVE-2023-22515 How does this detection method work? Th...

gitea -- Fix XSS vulnerabilities

Problem Description: The Wiki page did not sanitize author name the reviewer name on a "dismiss review" comment is also affected the migration page has some spots...

Privilege escalation in Liferay Portal

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page...

GHSA-MC8M-4R3W-Q2HW Privilege escalation in Liferay Portal

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page...

CVE-2022-45320

CVE-2022-45320 affects Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16. A remote authenticated user can become the owner of a wiki page by editing it (privilege escalation). This is a wiki-level ownership issue; exploitation sta...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

CVE-2022-45320

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page...

CVE-2022-45320

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page...

Cross-site Scripting (XSS)

miraheze/manage-wiki is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the columns and help keys interface messages within the form descriptor. An attacker requires the editinterface right to exploit this vulnerability...

BIT-LIFERAY-2023-42628

Stored cross-site scripting XSS vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject...

CVE-2024-21648 XWiki has no right protection on rollback action

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The rollback action is missing a right protection, a user can rollback to a previous version of the page to gain rights they don't have anymore. The problem has been patched in XWiki 14.10.17,...

CVE-2024-21651

CVE-2024-21651 affects XWiki Platform. A user can attach a file to a page that is parsed by Apache Tika as a malformed TAR file, triggering a denial of service through CPU consumption. The vulnerability is mitigated by fixes in XWiki releases 14.10.18, 15.5.3, and 15.8 RC1. The provided sources c...

GitLab 10.7 < 14.3.6 / 14.4 < 14.4.4 / 14.5 < 14.5.2 (CVE-2021-39936)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an...

CVE-2023-28873

An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor...

PT-2023-22023 · Seafile · Seafile

Name of the Vulnerable Software and Affected Versions: Seafile version 9.0.6 Description: An issue allows attackers to inject JavaScript into the Markdown editor in wiki and discussion pages. This is achieved through an XSS issue, which enables the execution of malicious scripts. Recommendations:...

MantisBT < 2.25.8 Information Disclosure Vulnerability - Windows

MantisBT is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mantisbt:mantisbt";...

MantisBT < 2.25.8 Information Disclosure Vulnerability - Linux

MantisBT is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mantisbt:mantisbt";...

PT-2023-8927 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 16.8.5 GitLab CE/EE versions 16.9 through 16.9.2 GitLab CE/EE versions 16.10 through 16.10.0 Description: An issue has been discovered in GitLab CE/EE, where a wiki page with a crafted payload may lead to a Stor...

CVE-2023-48241

XWiki Platform contains an information-disclosure flaw in the Solr-based search suggestion service. From CVE-2023-48241 and connected data, the vulnerability affects XWiki Platform versions starting at 6.3-milestone-2 up to but not including fixed releases: 14.10.15, 15.5.1, and 15.6RC1. The Solr...

GitLab: Stored-XSS injected in Wiki page via Banzai pipeline

A vulnerability was found in the AbstractReferenceFilter class of the GitLab project that could be exploited to inject arbitrary HTML elements, leading to a stored cross-site scripting XSS vulnerability. The issue was caused by the way the application handled the processing of wiki page content,...