mm-wiki 跨站请求伪造漏洞

MM-Wiki is phachon individual developers of a lightweight enterprise knowledge sharing and team collaboration software. It can be used to quickly build enterprise Wiki and team knowledge sharing platform. A security vulnerability exists in Phachon mm-wiki version v.0.1.2. A remote attacker can...

PT-2023-11517 · Phachon · Phachon Mm-Wiki

Name of the Vulnerable Software and Affected Versions: Phachon mm-wiki version 0.1.2 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via JavaScript code in the markdown editor. This could allow a remote attacker to execute arbitrary code, and any user...

CVE-2020-19278

Phachon mm-wiki v0.1.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that allows a remote attacker to execute arbitrary code via the system/user/save parameter. Affected component: Save functionality in user.go (as cited by multiple sources). Root cause: CSRF in the Save endpoi...

CVE-2020-19278

Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter...

PT-2023-11518 · Phachon · Mm-Wiki

Name of the Vulnerable Software and Affected Versions: Phachon mm-wiki version 0.1.2 Description: A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via the system/user/save parameter. Recommendations: For Phachon mm-wiki version 0.1.2, consider restricting acce...

CVE-2020-19277

CVE-2020-19277 : Cross Site Scripting in Phachon mm-wiki v0.1.2 allows a remote attacker to execute arbitrary code via JavaScript in the markdown editor. This is described across multiple sources (NVD, Red Hat, GHSA, OSV, etc.) as a stored/XSS vulnerability in mm-wiki’s markdown editor. The provi...

wiki-hilfe.de Cross Site Scripting vulnerability OBB-3244584

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-27480

CVE-2023-27480 affects XWiki Platform via an XXE/XAR-import vulnerability in the xwiki-platform-xar-model. A user with document edit rights can import a forged XAR file (XAR package) and cause server-side disclosure of file contents (e.g., arbitrary files) due to an XML external entity processing...

GHSA-3738-P9X3-MV9R XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

Impact It's possible to use the right of an existing document content author to execute a text area property. To reproduce: As an admin with programming rights, create a new user without script or programming right. Login with the freshly created user. Insert the following text in source mode in...

CVE-2023-26474

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds...

CVE-2023-26471

CVE-2023-26471 concerns XWiki Platform where, starting with 11.6-rc-1, comments can trigger an asynch macro that executes code with superadmin rights despite restricted mode. The underlying issue is that the async macro does not honor restricted mode, enabling any user with comment rights to run ...

CVE-2023-26474 XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds...

CVE-2023-26474 XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds...

CVE-2023-26477 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the newThemeName request parameter URL parameter, in combination with additional parameters. This has been...

CVE-2023-26477

Summary (mode C): XWiki Platform’s Flamingo theme UI is affected by an eval/command injection vulnerability that can be triggered through the newThemeName URL parameter when combined with other parameters. The issue allows injection of arbitrary wiki syntax, including Groovy, Python and Velocity ...

CVE-2023-26480

XWiki Platform is vulnerable to a stored cross-site scripting (XSS) via the Live Data macro. A user without script rights can inject XSS starting in version 12.10; this was fixed in versions 14.9, 14.4.7, and 13.10.10. Connected advisories (GHSA-32FQ-M2Q5-H83G and OSV) confirm the stored XSS via ...

CVE-2023-26480 XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarounds...

K54501561: Apple Mac OS X Wiki Server vulnerability CVE-2008-1579

Security Advisory Description Wiki Server in Apple Mac OS X 10.5 before 10.5.3 allows remote attackers to obtain sensitive information user names by reading the error message produced upon access to a nonexistent blog. CVE-2008-1579 Impact There is no impact; F5 products are not affected by this...

SUSE CVE-2005-1921

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...

SUSE CVE-2006-3257

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including 1 calendar/myagenda.php, 2 document/document.php, 3 phpbb/newtopic.php, 4 tracking/userLog.php, and 5 wiki/page.php...