Moodle SQL注入漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from insufficient cleansing of user-supplied data in an external Wiki method us...

wiki.centos-webpanel.com Cross Site Scripting vulnerability OBB-3280164

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-Site Request Forgery (CSRF)

github.com/phachon/mm-wiki is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in Save function of user.go which allows an attacker to execute arbitrary code via the system/user/save parameter...

CVE-2023-29518

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...

CVE-2023-29520

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This will lead to a broken page. The vulnerability has been...

CVE-2023-29512

CVE-2023-29512 affects XWiki Platform. The issue is a code injection vulnerability where an ordinary user with edit rights can execute arbitrary Groovy, Python, or Velocity code due to improper escaping of information loaded from attachments in imported.vm, importinline.vm, and packagelist.vm, po...

CVE-2023-29522

CVE-2023-29522 affects XWiki Platform. Any user with view rights can execute arbitrary script macros (Groovy/Python) that enable remote code execution and unrestricted read/write access to wiki contents. The attack is triggered by opening a non-existing page whose name contains a dangerous payloa...

CVE-2023-29523

CVE-2023-29523 – XWiki Platform code injection via display method : Affects XWiki Platform where any user who can edit their own profile can run arbitrary script macros (Groovy/Python), enabling remote code execution and unrestricted read/write of wiki content. The vulnerability can also occur wh...

CVE-2023-29527 Code injection from account through AWM view sheet in xwiki platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile or any other document with the wiki editor and add groovy script content. Viewing the document after...

XWiki Platform 访问控制错误漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from XWiki France. An Access Control Error vulnerability exists in XWiki Platform, which arises if a guest has view rights to any document. It is possible to use distribution/firstadminuser.wiki to create a ne...

PT-2023-8609 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.3 XWiki Platform versions prior to 15.0-rc-1 Description: The issue allows a user without script or programming rights to edit a user profile or any other document with the wiki editor and add groovy...

XWiki Platform 注入漏洞

XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. XWiki Platform suffers from an injection vulnerability that originates from the execution of arbitrary script macros, including Groovy and Python macros that allow remote code...

CVE-2023-29527: Improper Neutralization of Special Elements in Output Used by a Downstream Component

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile or any other document with the wiki editor and add groovy script content. Viewing the document after...

PT-2023-22301 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.2 XWiki Platform versions prior to 15.0RC1 Description: The issue allows any user who can edit their own user profile to...

XWiki Commons 代码注入漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user with view rights to WikiManager.DeleteWiki can execute arbitrary Groovy, Python, or Velocity code in XWiki to gain full acces...

Cross site scripting

XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter content was set to true. This allowed arbitrary HTML and in particular...

[SECURITY] Fedora 38 Update: mediawiki-1.39.3-1.fc38

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

MediaWiki authorization error vulnerability (CNVD-2023-29701)

MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...

PT-2023-22288

Name of the Vulnerable Software and Affected Versions XWiki versions 13.10.8 through 13.10.10 XWiki versions 14.4.3 through 14.4.6 XWiki versions 14.6 through 14.9 Description The issue allows code injection using the URL of authenticated endpoints, such as the /xwiki/authenticate/wiki/xwiki...

Fedora: Security Advisory for mediawiki (FEDORA-2023-567baef490)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...