CVE-2022-29252

XWiki Platform Wiki UI Main Wiki contains a cross-site scripting vector in the WikiManager.JoinWiki page (field requestJoin) starting with version 5.3-milestone-2. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. A workaround is to edit WikiManager.JoinWiki using the wik...

CVE-2022-29252 Cross-site Scripting in XWiki Platform Wiki UI Main Wiki

XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possible cross-site scripting vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field. The issue is patched in versions...

Rancher Login Parameter Can Be Edited

A vulnerability exists in Rancher 2.1.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legitimate users to visit...

GHSA-H7JC-PG2R-MQJ4 Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-MPX3-MX2P-9GV3 Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMANDPATTERN and TESTRUNNER in the pageContent parameter when editing a page...

GHSA-437P-QW95-WQQR Trac vulnerable to denial of service

Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup."...

GHSA-7F2F-CRXG-CPFV Tiki Wiki CMS XSS Vulnerability

Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...

Tiki Wiki CMS XSS Vulnerability

Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS...

Moodle vulnerable to Cross-Site Scripting

Cross-site scripting XSS vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment...

GHSA-8HXM-42V5-66HM Moodle vulnerable to Cross-Site Request Forgery

Multiple cross-site request forgery CSRF vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data...

GHSA-2VHR-4MHQ-M35C Moodle does not properly restrict access

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict 1 view and 2 edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to...

Moodle does not properly restrict access

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict 1 view and 2 edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to...

GHSA-44XP-WJ24-9XXJ Moodle allows attackers to delete files

The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button i...

Moodle allows attackers to delete files

The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button i...

GHSA-P3HJ-CFHM-7G6V Moodle allows attackers to remove wiki pages

mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki...

CVE-2020-22986

Cross-Site Scripting XSS vulnerability in MicroStrategy Web SDK 10.11 and earlier, allows remote unauthenticated attackers to execute arbitrary code via the searchString parameter to the wikiScrapper task...

CVE-2022-1681

Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions...

CVE-2022-1681 Authentication Bypass Using an Alternate Path or Channel in requarks/wiki

Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions...

CVE-2022-1681

CVE-2022-1681 affects Wiki.js (Requarks) prior to version 2.5.281. The vulnerability is an authentication bypass via an alternate path or channel that could allow an attacker to gain root-equivalent permissions on the system. The issue arises in Wiki.js and is documented across multiple sources (...