XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Impact Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords. Workarounds Remove the Calendar.JSONService page. This will however break some functionalities. References Jira...

Cross site scripting

Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 tiki-adminsystem.php, 2 tiki-pagehistory.php, 3 tiki-removepage.php, or 4 tiki-renamepage.php...

Persistent XSS in the removepage.action page through the title of the parent page being deleted

The parent title of a confluence page is not html encoded when displayed in removepage.action this results in a persistent XSS vector. Steps to reproduce: 1. Add a page with a title of "" alert3; 2. from the Add menu select "Add page" so it is a child of the first page 3. save the new page child ...