Remote code execution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code executio...

CVE-2023-34466

CVE-2023-34466 affects XWiki Platform’s tag API. The vulnerability leaks tags from pages not viewable to the current user, enabling inference of the document reference for non-viewable pages. Affected versions are 5.0-milestone-1 up to 14.4.8, 14.10.4, and 15.0-rc-1. The issue is resolved in the ...

CVE-2023-35166

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5...

CVE-2023-35166 Privilege escalation (PR) from account through TipsPanel

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5...

CVE-2023-35166

CVE-2023-35166 affects XWiki Platform via the TipsPanel UI extension. An attacker could cause arbitrary wiki content execution by creating a UIExtensionClass object and configuring the tip UI extension, enabling code execution (notably via groovy) when accessing Help.TipsPanel. Mitigation: patche...

PT-2023-25177 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.5 XWiki Platform versions prior to 15.1-rc-1 Description: The issue allows execution of any wiki content with the rights of the TipsPanel author by creating a tip UI extension. This can be achieved by...

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

Summary IBM Cloud Pak for Security includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version of Cloud Pak for Security...

CVE-2023-29720

SofaWiki =3.8.9 is vulnerable to Cross Site Scripting XSS via index.php...

PT-2023-22372 · Sofawiki · Sofawiki

Name of the Vulnerable Software and Affected Versions: SofaWiki versions prior to 3.8.10 Description: The issue is related to Cross Site Scripting XSS that can be exploited via the index.php file. Recommendations: For versions prior to 3.8.10, update to version 3.8.10 or later to resolve the issu...

Fedora 36 : moodle (2023-49eb814ccc)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-49eb814ccc advisory. Fixes for CVE-2023-30943 and CVE-2023-30944. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

CVE-2023-30944

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

UBUNTU-CVE-2023-30944

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

Moodle SQL注入漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from insufficient cleansing of user-supplied data in an external Wiki method us...

CVE-2023-30944 Moodle: minor sql injection risk in external wiki method for listing pages

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

CVE-2023-30944 Moodle: minor sql injection risk in external wiki method for listing pages

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

CVE-2023-30944 Moodle: minor sql injection risk in external wiki method for listing pages

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

wiki.centos-webpanel.com Cross Site Scripting vulnerability OBB-3280164

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-Site Request Forgery (CSRF)

github.com/phachon/mm-wiki is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in Save function of user.go which allows an attacker to execute arbitrary code via the system/user/save parameter...

CVE-2023-29520

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object. This will lead to a broken page. The vulnerability has been...

CVE-2023-29518

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...