CVE-2019-10087

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about...

Cross-site Scriptin in JSPWiki

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable...

GHSA-CXX2-FP39-RF3R Cross-Site Scripting in JSPWiki

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...

Cross-Site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a malicious attachment via the AttachmentTab to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a malicious InterWiki link to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

Apache JSPWiki is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the ReferredPagesPlugin and navigation breadcrumbs, to steal session tokens or perform unwanted actions on behalf of the user...

CVE-2019-10076

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...

CVE-2019-10077

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...

CVE-2019-10078

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable...

CVE-2019-10076

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...

CVE-2019-10078

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable...

CVE-2019-10078

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable...

CVE-2019-10078

CVE-2019-10078 affects Apache JSPWiki (versions 2.9.0 through 2.11.0.M3). A carefully crafted plugin link invocation can trigger a cross-site scripting (XSS) vulnerability, leading to possible session hijacking. Multiple plugins were implicated, not just ReferredPagesPlugin, according to initial ...

CVE-2019-10077

CVE-2019-10077 affects Apache JSPWiki 2.9.0 to 2.11.0.M3 via a crafted InterWiki link that triggers an XSS vulnerability, potentially enabling session hijacking. The vulnerability is tied to JSPWiki before 2.11.0.M4 (as referenced by OpenVAS) and related advisories; upgrading to 2.11.0.M4 or late...

CVE-2019-10076

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking...

CVE-2019-10076

CVE-2019-10076 affects Apache JSPWiki 2.9.0 through 2.11.0.M3 and is described as a cross-site scripting (XSS) vulnerability triggered by a carefully crafted malicious attachment, potentially leading to session hijacking. The connected documents consistently reference the same affected product/ve...

GHSA-FMPQ-W5Q6-9VF9 Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main

In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser...

CVE-2019-0225

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details...

CVE-2019-0225

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details...

Design/Logic Flaw

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details...