CVE-2023-44394 Disclosure of project names to unauthorized users in MantisBT

MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit 65c44883f which has been included in release...

MantisBT Information Disclosure Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in a web-operable format. An information disclosure vulnerability exists in MantisBT 2.25.7 and earlier versions, which stems from insufficient...

[SECURITY] Fedora 39 Update: mediawiki-1.39.4-1.fc39

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in its lack of protection for website structures. This allows attackers to insert arbitrary information into wiki projects.

The vulnerability of the XWiki Platform lies in the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to insert arbitrary information into the wiki project remotely...

Fedora: Security Advisory for mediawiki (FEDORA-2023-1fcaba0998)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: mediawiki-1.38.7-1.fc37

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[SECURITY] Fedora 38 Update: mediawiki-1.39.4-1.fc38

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

XWiki Platform 访问控制错误漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the XWiki Foundation in France. XWiki Platform suffers from an Access Control Error vulnerability that stems from a security flaw in Groovy job checking. The vulnerability can be exploited by an attacker...

Privilege escalation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

CVE-2023-40177

CVE-2023-40177 affects XWiki Platform: a vulnerability where any registered user can use the user profile content field to execute arbitrary scripts with programming rights, effectively escalating privileges. Root cause: AppWithinMinutes.Content displayer executes content with the rights of the A...

XWiki Platform 代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating collaborative Web applications from the XWiki Foundation in France. The XWiki Platform suffers from a code injection vulnerability that originates from the fact that any user with access to the Invitation.WebHome can execute arbitrary...

Improper Access Control

gitlab is vulnerable to Improper Access Control. An attacker could exploit this vulnerability to access a project's disabled wiki, even if they do not have the necessary permissions. This could allow the attacker to view or modify the wiki's contents, or to gain access to sensitive data that may ...

Arbitrary File Read

gitlab is vulnerable to Arbitrary File Read. This vulnerability occurs due to a flaw in the way that GitLab handles Wiki pages. An attacker can exploit this vulnerability to read arbitrary files on the server, including files that are not accessible to normal users...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability occurs due to an improper filtering of query parameters in the wiki changes page allowing a malicious authenticated attacker to execute arbitrary javascript on self-hosted instances running without strict CSP...

Microsoft Media-Wiki Extensions 安全漏洞

Microsoft Media-Wiki Extensions is an extension from Microsoft Corporation USA. A security vulnerability exists in Microsoft Media-Wiki Extensions. An attacker could exploit the vulnerability to remotely execute code...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in several Developer Tools. A malicious person with access to the development environment can exploit the vulnerabilities to exploit attacks that could lead to the following categories of damage: Bypassing security measure. Remote code execution User rights...

Azure DevOps Server 2022 XSS

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by a cross-site scripting vulnerability. An attacker who successfully exploited the vulnerability could access data that is available for the current user. Depending on the user's...

The vulnerability in the virtual training environment Moodle, related to insufficient data cleaning, allows a malicious user to execute arbitrary SQL queries in the database.

The vulnerability in the virtual training environment Moodle is related to insufficient cleaning of data provided by users in the external Wiki method for listing pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries in the database...

CVE-2023-36469 Code injection through NotificationRSSService in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including...

CVE-2023-35162 XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as:...