3541 matches found
CVE-2021-21380 Rating Script Service expose XWiki to SQL injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform and only those with the Ratings API installed, the Rating Script Service expose an API to perform SQL requests without escaping the from and where search...
Thomas Mortagne xwiki-platform SQL注入漏洞
Xwiki Platform is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to SQL injection, which can be exploited by attackers to inject SQL statements for execution...
Xwiki Platform Injection Vulnerability
Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to an injection vulnerability that originates from the author of a wiki macro executing content with the privileges of the author of the wiki macro, rather tha...
XWiki >= 11.4-rc-1, < 11.10.1, 12.x < 12.6.3, 12.7.x Privilege Escalation Vulnerability
XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-21379
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
CVE-2021-21379
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
CVE-2021-21379
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
Code injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
CVE-2021-21379 It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
CVE-2021-21379
XWiki Platform is affected by a vulnerability where the {{wikimacrocontent}} macro executes content with the rights of the macro author rather than the caller, enabling potential script injection. Affected versions are patched in XWiki 12.6.3, 11.10.11, and 12.8-rc-1. There is no easy workaround ...
Xwiki Platform 注入漏洞
Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to an injection vulnerability that originates from the author of a wiki macro executing content with the privileges of the author of the wiki macro, rather tha...
XWiki <= 12.10.2 XSS Vulnerability
XWiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cross-site Scripting (XSS)
xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...
Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
GHSA-43HG-G44Q-474Q Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
Design/Logic Flaw
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
CVE-2021-3137 affects XWiki 12.10.2, enabling XSS via an SVG document uploaded to the comment feature. Root cause: insecure handling of SVG uploads leading to script injection. Impact: cross-site scripting in affected deployments. Mitigation: vendor fix (VendorFix) referenced by OpenVAS entries; ...