CVE-2023-35158

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:...

CVE-2023-35160

XWiki Platform (2.5-milestone-2 and earlier) is affected by a reflected cross-site scripting (XSS) vulnerability in the resubmit template, exploitable via crafted URLs using back and xcontinue parameters (e.g., xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(docum...

Craft CMS subject to URL forgery

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

GHSA-J27G-R58Q-624W Craft CMS subject to URL forgery

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

No CSRF protection on the password change form

Impact It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. Patches The problem has been patched in XWiki 12.10.5, 13.2RC1. Workarounds It's possible to apply the patch manually by modifying the registermacros.vm template like in...

CVE-2019-12836

CVE-2019-12836 affects Bobronix JEditor editor for Jira (JEditor) prior to version 3.0.6. The vulnerability is a cross-site request forgery (CSRF) in which an attacker can induce an authenticated user to follow a link that causes a forged request to an out-of-origin domain, enabling theft of sess...

Updated drupal packages fix security vulnerabilities

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password CVE-2015-2559. Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd...