CVE-2023-26478 org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function

XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, org.xwiki.store.script.TemporaryAttachmentsScriptServiceuploadTemporaryAttachment returns an instance of com.xpn.xwiki.doc.XWikiAttachment. This class is not supported to be exposed to users without the programing right...

CVE-2023-26479

XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index if the page containing the faulty content is a user page and t...

CVE-2023-26479 org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions

XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index if the page containing the faulty content is a user page and t...

CVE-2023-26479 org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions

XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index if the page containing the faulty content is a user page and t...

CVE-2023-26479

CVE-2023-26479 affects XWiki Platform rendering/parser. From version 6.0, users with write rights can insert content that the parser handles poorly, causing stack overflow and rendering issues that make some pages unusable (including the user index and page index). The issue is mitigated by patch...

CVE-2023-26479 org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions

XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the parser. As a consequence, some pages becomes unusable, including the user index if the page containing the faulty content is a user page and t...

CVE-2023-26480

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

CVE-2023-26480 XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

CVE-2023-26480

XWiki Platform is vulnerable to a stored cross-site scripting (XSS) via the Live Data macro. A user without script rights can inject XSS starting in version 12.10; this was fixed in versions 14.9, 14.4.7, and 13.10.10. Connected advisories (GHSA-32FQ-M2Q5-H83G and OSV) confirm the stored XSS via ...

CVE-2023-26480 XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

CVE-2023-26480 XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

xwiki-platform vulnerable to Remote Code Execution in Annotations

Impact The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document. To reproduce: add an annotation with the content groovyprint "hello"/groovy and click the yellow scare to g...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that originates from the fact that any user with editing privileges can execute arbitrary database selections and access data...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that stems from insufficient authentication of user rights...

PT-2023-20661 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.0 Description: The issue allows an attacker to make the farm unusable by adding an object to a page with a huge number, filling the memory allocated to XWiki and making it unusable every time the document i...

PT-2023-20663 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 6.2-milestone-1 through 14.8 XWiki Platform versions 14.4 through 14.4.5 XWiki Platform versions 13.10 through 13.10.9 Description: XWiki Platform is a generic wiki platform where, starting in version 6.2-milestone-1,...

PT-2023-20667

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 3.2-m3 through 13.4.3 XWiki Platform versions 3.2-m3 through 13.10.8 XWiki Platform versions prior to 14.7-rc-1 Description XWiki Platform is a generic wiki platform. The issue allows users to deduce the content of the...

XWiki Platform 缓冲区错误漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform versions prior to 14.0-rc-1, which stems from an out-of-memory vulnerability that can be exploited by an attacker to cause a...

PT-2023-20672 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 12.10 through 14.4.6 XWiki Platform versions 13.10.9 and earlier XWiki Platform version 14.9 is not affected, but versions prior to 14.9 are vulnerable, however since 14.4.7 is a fixed version, we consider versions pri...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that stems from the ability of a user without scripting privileges to use live data macros to cause stored cross-site scripting...