2059 matches found
CVE-2023-29512
CVE-2023-29512 affects XWiki Platform. The issue is a code injection vulnerability where an ordinary user with edit rights can execute arbitrary Groovy, Python, or Velocity code due to improper escaping of information loaded from attachments in imported.vm, importinline.vm, and packagelist.vm, po...
CVE-2023-29522
CVE-2023-29522 affects XWiki Platform. Any user with view rights can execute arbitrary script macros (Groovy/Python) that enable remote code execution and unrestricted read/write access to wiki contents. The attack is triggered by opening a non-existing page whose name contains a dangerous payloa...
CVE-2023-29523
CVE-2023-29523 – XWiki Platform code injection via display method : Affects XWiki Platform where any user who can edit their own profile can run arbitrary script macros (Groovy/Python), enabling remote code execution and unrestricted read/write of wiki content. The vulnerability can also occur wh...
CVE-2023-29527 Code injection from account through AWM view sheet in xwiki platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programming right may edit a user profile or any other document with the wiki editor and add groovy script content. Viewing the document after...
PT-2023-8609 · Unknown · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.3 XWiki Platform versions prior to 15.0-rc-1 Description: The issue allows a user without script or programming rights to edit a user profile or any other document with the wiki editor and add groovy...
XWiki Platform 访问控制错误漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from XWiki France. An Access Control Error vulnerability exists in XWiki Platform, which arises if a guest has view rights to any document. It is possible to use distribution/firstadminuser.wiki to create a ne...
XWiki Platform 注入漏洞
XWiki Platform is a suite of wiki platforms for creating web collaboration applications from the French company XWiki. XWiki Platform suffers from an injection vulnerability that originates from the execution of arbitrary script macros, including Groovy and Python macros that allow remote code...
PT-2023-22301 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.11 XWiki Platform versions prior to 14.4.8 XWiki Platform versions prior to 14.10.2 XWiki Platform versions prior to 15.0RC1 Description: The issue allows any user who can edit their own user profile to...
XWiki Commons 代码注入漏洞
XWiki Commons is a technology library shared by several other top XWiki projects. A security vulnerability exists in XWiki Commons, which stems from the fact that any user with view rights to WikiManager.DeleteWiki can execute arbitrary Groovy, Python, or Velocity code in XWiki to gain full acces...
Cross site scripting
XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter content was set to true. This allowed arbitrary HTML and in particular...
[SECURITY] Fedora 38 Update: mediawiki-1.39.3-1.fc38
MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...
MediaWiki authorization error vulnerability (CNVD-2023-29701)
MediaWiki is a free and free-to-use web-based wiki engine from the MediaWiki Foundation, which can be used to deploy in-house knowledge management and content management systems. An authorization error vulnerability exists in the MediaWiki GrowthExperiments extension, which could be exploited by ...
Fedora: Security Advisory for mediawiki (FEDORA-2023-567baef490)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS)
Phachon mm-wiki v.0.1.2 vulnerable to stored cross-site scripting XSS. This could allow a remote attacker to execute arbitrary code via JavaScript code in the markdown editor. Any user browsing the document containing XSS malicious code will trigger the vulnerability...
Phachon mm-wiki Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter...
GHSA-F6XP-59JQ-R35C Phachon mm-wiki Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter...
GHSA-F7RP-XX67-4PJ9 Phachon mm-wiki vulnerable to stored cross-site scripting (XSS)
Phachon mm-wiki v.0.1.2 vulnerable to stored cross-site scripting XSS. This could allow a remote attacker to execute arbitrary code via JavaScript code in the markdown editor. Any user browsing the document containing XSS malicious code will trigger the vulnerability...
CVE-2020-19277
Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code in the markdown editor...