Tiki Wiki CMS Groupware 24.1 tikiimporter_blog_wordpress.php PHP Object Injection

---------------------------------------------------------------------------------------------------- Tiki Wiki CMS Groupware input type="...

Tiki Wiki CMS Groupware 24.1 tikiimporter_blog_wordpress.php PHP Object Injection Vulnerability

---------------------------------------------------------------------------------------------------- Tiki Wiki CMS Groupware input type="fi...

Tiki Wiki CMS Groupware 信息泄露漏洞

Tiki Wiki CMS Groupware is a Wiki-based open source content management system and online office suite. A security vulnerability exists in Tiki Wiki CMS Groupware version 24.0 and earlier versions, which stems from a PHP object injection in grid.php...

Tiki Wiki CMS Groupware 24.0 grid.php PHP Object Injection Vulnerability

----------------------------------------------------------------------------- Tiki Wiki CMS Groupware const popChain = 'O:25:"SearchElasticConnection":1:S:31:"\00SearchElasticConnection\00bulk";O:28:"SearchElasticBulkOper...

CVE-2021-44854

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis...

U.S. Dept Of Defense: Improper Access Control on Media Wiki allows an attackers to restart installation on DoD asset

An improper access control vulnerability was found on a MediaWiki website, allowing attackers to restart the installation process without authentication. The vulnerability was fixed by blocking all access to the mw-config folder...

DEBIAN-CVE-2022-44030

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user...

UBUNTU-CVE-2022-44030

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user...

Unspecified Vulnerability in XWiki Platform

XWik Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security error vulnerability exists in XWiki Platform. An attacker exploited the vulnerability to cause a degradation in database performance...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki...

CVE-2022-41934

CVE-2022-41934 affects XWiki Platform, where any user with view rights on common documents (including the menu macro) can inject and execute arbitrary Groovy, Python, or Velocity code due to improper escaping of macro content and menu macro parameters, potentially gaining full control of the XWik...

CVE-2022-41932

Summary: CVE-2022-41932 affects XWiki Platform and allows an attacker to trigger creation of many new schemas and tables by supplying a crafted user identifier in the login form, causing degraded database performance. The underlying issue is a design/logic flaw that enables uncontrolled resource ...

CVE-2022-41937 Missing Authorization in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.6RC1, 14.6 and 13.10.8. As a...

CVE-2022-41937

XWiki Platform suffered a Missing Authorization vulnerability where any user with view access could modify pages by importing a crafted XAR package. The issue stems from improper privilege management and was fixed in XWiki 14.6RC1, 14.6, and 13.10.8. A workaround is to restrict the Filter.WebHome...

CVE-2022-42000

Cross-site Scripting XSS vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into the comment section of a wikipage...

CVE-2022-41814

Cross-site Scripting XSS vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the history view of a wikipage...

CVE-2022-41789

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage...

CVE-2022-42128

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API...

PT-2022-26074 · Bluespice · Bluespice

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a logged-in user with edit permissions to inject arbitrary HTML into the default page header of a wiki page due to a Cross-site Scripting XSS vulnerability in the...

PT-2022-26205 · Unknown +1 · Bluespicesocialprofile +1

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a user with comment permissions to inject arbitrary HTML into the comment section of a wikipage, which can lead to Cross-site Scripting XSS. This occurs in the...