org.xwiki.rendering:xwiki-rendering-macro-html (13.10), org.xwiki.rendering:xwiki-rendering-standalone (13.10) +1 more potentially affected by CVE-2023-32070 +1 more via org.xwiki.rendering:xwiki-rendering-syntax-html5 (13.10)

org.xwiki.rendering:xwiki-rendering-syntax-html5 MAVEN version 13.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-syntax-html5 and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 13.10 -...

org.xwiki.rendering:xwiki-rendering-macro-html (7.4.4), org.xwiki.rendering:xwiki-rendering-standalone (7.4.4) +7 more potentially affected by CVE-2023-32070 +1 more via org.xwiki.rendering:xwiki-rendering-syntax-xhtml (7.4.4)

org.xwiki.rendering:xwiki-rendering-syntax-xhtml MAVEN version 7.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-syntax-xhtml and may be impacted: - org.xwiki.rendering:xwiki-rendering-macro-html 7.4.4 -...

org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 (7.0-rc-1) potentially affected by CVE-2023-32070 +1 more via org.xwiki.rendering:xwiki-rendering-syntax-html5 (7.0-rc-1)

org.xwiki.rendering:xwiki-rendering-syntax-html5 MAVEN version 7.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.xwiki.rendering:xwiki-rendering-syntax-html5 and may be impacted: - org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5...

PT-2023-26177 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 14.6-rc-1 through 14.10.3 XWiki versions prior to 15.0 RC1 Description: The issue concerns the cleaning of attributes during XHTML rendering in XWiki, which allowed the injection of arbitrary HTML code and thus cross-site...

org.xwiki.rendering:xwiki-rendering-macro-html (>=3.2-milestone-3, <=14.5), org.xwiki.rendering:xwiki-rendering-standalone (>=4.4-rc-1, <=14.5) +9 more potentially affected by CVE-2023-32070 via org.xwiki.rendering:xwiki-rendering-syntax-xhtml (>=3.2-milestone-3, <=14.5)

org.xwiki.rendering:xwiki-rendering-syntax-xhtml MAVEN version =3.2-milestone-3, =3.2-milestone-3, =4.4-rc-1, =6.4-milestone-3, =4.5-milestone-1, =5.4.5, =4.1-milestone-1, =6.4-milestone-3, =4.1-milestone-1, =5.2-rc-1, =5.2-rc-1, =14.1-rc-1, =14.5 Source cves: CVE-2023-32070 Source advisory:...

org.xwiki.rendering:xwiki-rendering-macro-html (>=11.4-rc-1, <=14.5), org.xwiki.rendering:xwiki-rendering-standalone (>=4.5-milestone-1, <=14.5) +1 more potentially affected by CVE-2023-32070 via org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml (>=4.5-milestone-1, <=14.5)

org.xwiki.rendering:xwiki-rendering-syntax-annotatedxhtml MAVEN version =4.5-milestone-1, =11.4-rc-1, =4.5-milestone-1, =6.4-milestone-3, =14.5 Source cves: CVE-2023-32070 Source advisory: MEND:CVE-2023-32070...

org.xwiki.rendering:xwiki-rendering-macro-html (>=11.4-rc-1, <=14.5), org.xwiki.rendering:xwiki-rendering-standalone (>=11.4-rc-1, <=14.5) +1 more potentially affected by CVE-2023-32070 via org.xwiki.rendering:xwiki-rendering-syntax-html5 (>=6.4-milestone-3, <=14.5)

org.xwiki.rendering:xwiki-rendering-syntax-html5 MAVEN version =6.4-milestone-3, =11.4-rc-1, =11.4-rc-1, =6.4-milestone-3, =14.5 Source cves: CVE-2023-32070 Source advisory: MEND:CVE-2023-32070...

org.xwiki.rendering:xwiki-rendering-macro-html (>=11.4-rc-1, <=14.5), org.xwiki.rendering:xwiki-rendering-standalone (>=11.4-rc-1, <=14.5) potentially affected by CVE-2023-32070 via org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 (>=11.4-rc-1, <=14.5)

org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5 MAVEN version =11.4-rc-1, =11.4-rc-1, =11.4-rc-1, =14.5 Source cves: CVE-2023-32070 Source advisory: MEND:CVE-2023-32070...

PT-2023-23582

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 14.6-rc-1 Description The issue concerns HTML rendering not checking for dangerous attributes or attribute values, allowing cross-site scripting XSS attacks via attributes and link URLs in XWiki syntax...

CVE-2023-32070: Improper Neutralization of Script in Attributes in a Web Page

XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cross-site scripting XSS attacks via attributes and link URLs, e.g., supported in XWiki syntax. This has been patched in XWiki 14.6-rc-1. Ther...

Moderate: Red Hat Security Advisory: golang-github-cpuguy83-md2man security, bug fix, and enhancement update

An update for golang-github-cpuguy83-md2man is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: git-lfs security and bug fix update

An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

[SECURITY] Fedora 38 Update: rust-git-delta-0.13.0-5.fc38

Syntax-highlighting pager for git...

[SECURITY] Fedora 36 Update: lilypond-2.24.1-1.fc36

LilyPond is an automated music engraving system. It formats music beautifully and automatically, and has a friendly syntax for its input files...

[SECURITY] Fedora 36 Update: lilypond-doc-2.24.1-1.fc36

LilyPond is an automated music engraving system. It formats music beautifully and automatically, and has a friendly syntax for its input files. This package contains the HTML documentation for LilyPond...

[SECURITY] Fedora 37 Update: lilypond-2.24.1-1.fc37

LilyPond is an automated music engraving system. It formats music beautifully and automatically, and has a friendly syntax for its input files...

GHSA-JGG7-W2RJ-58CJ XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration

Impact Steps to reproduce: Open...

CVE-2023-29525: Improper Neutralization of Special Elements in Output Used by a Downstream Component

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injection in the since parameter of the /xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration endpoint. This provides an XWik...

Pentaho Business Analytics Server Code Execution

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in errors in the processing of input data during syntax analysis of code. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...