3555 matches found
CVE-2010-4641
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
Design/Logic Flaw
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from thir...
CVE-2007-4898
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from thir...
CVE-2007-4898
Technical details about CVE-2007-4898 are not publicly provided in the supplied documents. Monitor for updates from official advisories; current entries summarize an unspecified vulnerability in XWiki Multiwiki prior to 1.1 Enterprise RC2 without concrete technical specifics.
CVE-2007-4898
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from thir...
CVE-2006-7223
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifyi...
CVE-2007-4888
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...
Code injection
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...
CVE-2006-7223
CVE-2006-7223 affects XWiki 0.9.543 through 0.9.1252. The underlying issue is that PreviewAction does not set the Author field to the identity of the user who last modified a document. This allows remote authenticated users without programming rights to execute arbitrary code by selecting a docum...
CVE-2007-4888
The CVE-2007-4888 entry concerns XWiki 1.0 B1 and 1.0 B2. The issue is an error handler flaw where the doc variable is associated with the entire document content and metadata regardless of a user’s view rights. This allows remote authenticated users to read arbitrary documents by using a custom ...
CVE-2005-4862
The CVE-2005-4862 entry concerns XWiki 0.9.793, where the search functionality indexes cleartext user passwords. This concrete flaw permits remote attackers to obtain sensitive information by submitting a search string that matches a password. No exploitation details or remediation are provided i...
CVE-2006-7223
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifyi...
CVE-2007-4888
The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribu...