CVE-2023-26474 XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds...

CVE-2023-26475 XWiki Platform vulnerable to Remote Code Execution in Annotations

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki...

CVE-2023-26475 XWiki Platform vulnerable to Remote Code Execution in Annotations

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki...

CVE-2023-26475

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki...

CVE-2023-26475

Summary: CVE-2023-26475 affects the XWiki Platform. The vulnerability arises from the annotation displayer executing content outside a restricted context, allowing code execution with the author’s privileges when annotating a document. Impact: remote code execution with high risk; authenticated u...

CVE-2023-26475 XWiki Platform vulnerable to Remote Code Execution in Annotations

XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. This has been patched in XWiki...

CVE-2023-26476 Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version ...

CVE-2023-26476

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to "LiveTableResults" and "WikisLiveTableResultsMacros". The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in...

CVE-2023-26476

CVE-2023-26476 affects XWiki Platform. Starting in 3.2-m3, attackers could deduce password-field contents via repeated calls to LiveTableResults and WikisLiveTableResultsMacros. Public details confirm fixes: upgrade to 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or apply the patch manually on LiveT...

CVE-2023-26476 Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version ...

CVE-2023-26476 Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to LiveTableResults and WikisLiveTableResultsMacros. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, or 13.10.9 and higher, or in version ...

CVE-2023-26477 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477

Summary (mode C): XWiki Platform’s Flamingo theme UI is affected by an eval/command injection vulnerability that can be triggered through the newThemeName URL parameter when combined with other parameters. The issue allows injection of arbitrary wiki syntax, including Groovy, Python and Velocity ...

CVE-2023-26477

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the "newThemeName" request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26478

XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, "org.xwiki.store.script.TemporaryAttachmentsScriptServiceuploadTemporaryAttachment" returns an instance of "com.xpn.xwiki.doc.XWikiAttachment". This class is not supported to be exposed to users without the "programing"...

CVE-2023-26478

Summary: CVE-2023-26478 affects XWiki Platform. Starting with 14.3-rc-1, TemporaryAttachmentsScriptService#uploadTemporaryAttachment may return XWikiAttachment, which is not allowed to be exposed without the proper rights. Use com.xpn.xwiki.api.Attachment and rights checks instead. This has been ...

CVE-2023-26478 org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function

XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptServiceuploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right...

CVE-2023-26478 org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function

XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptServiceuploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right...