3549 matches found
CVE-2007-4888
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...
Code injection
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...
CVE-2006-7223
CVE-2006-7223 affects XWiki 0.9.543 through 0.9.1252. The underlying issue is that PreviewAction does not set the Author field to the identity of the user who last modified a document. This allows remote authenticated users without programming rights to execute arbitrary code by selecting a docum...
CVE-2006-7223
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifyi...
CVE-2007-4888
The CVE-2007-4888 entry concerns XWiki 1.0 B1 and 1.0 B2. The issue is an error handler flaw where the doc variable is associated with the entire document content and metadata regardless of a user’s view rights. This allows remote authenticated users to read arbitrary documents by using a custom ...
CVE-2005-4862
The CVE-2005-4862 entry concerns XWiki 0.9.793, where the search functionality indexes cleartext user passwords. This concrete flaw permits remote attackers to obtain sensitive information by submitting a search string that matches a password. No exploitation details or remediation are provided i...
CVE-2007-4888
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...