26 matches found
MiracleLinux 9 : pcre2-10.37-5.el9 (AXSA:2022-3985:02)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3985:02 advisory. pcre2: Out-of-bounds read in compilexclassmatchingpath in pcre2jitcompile.c CVE-2022-1586 pcre2: Out-of-bounds read in getrecursedatalength in...
EUVD-2025-18297
Malicious code in bioql PyPI...
EUVD-2025-18299
Malicious code in bioql PyPI...
CVE-2025-49585
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...
XWiki does not require right warnings for XClass definitions
Impact When an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior...
GHSA-59W6-R9HM-439H XWiki does not require right warnings for XClass definitions
Impact When an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior...
CVE-2025-49586 XWiki allows remote code execution through preview of XClass changes in AWM editor
XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application the default for all users XWiki can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0,...
CVE-2025-49585 XWiki does not require right warnings for XClass definitions
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...
CVE-2025-49585
XWiki vulnerability CVE-2025-49585 affects multiple pre-patched releases: before 15.10.16, 16.0.0-rc-1 → 16.4.6, and 16.5.0-rc-1 → 16.10.1. An attacker with no script/programming rights can create an XClass definition (requires edit rights), and if the same document is later edited by someone wit...
CVE-2025-49585 XWiki does not require right warnings for XClass definitions
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...
CVE-2025-49585 XWiki does not require right warnings for XClass definitions
XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions prior to 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, which stems from an XClass definition that could le...
GHSA-WCG9-PGQV-XM5V XWiki Platform allows XSS through XClass name in string properties
Impact Is it possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Reproduction steps 1. As a user without script or programming right, create a non-terminal document...
CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. Thi...
CVE-2023-41046
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...
Input validation
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...
CVE-2023-41046
CVE-2023-41046 describes a velocity code execution flaw in XWiki Platform where VelocityCode/VelocityWiki properties can run Velocity without script rights. The code executes with the correct context author, but cannot access privileged APIs; however, it may access data/APIs that enable further p...
CVE-2023-41046 Velocity execution without script rights in Xwiki platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the...
GHSA-9HQH-FMHG-VQ2J Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
Impact Any user with the right to edit his personal page can follow one of the scenario below: Scenario 1: - Log in as a simple user with just edit rights on the user profile - Go to the user's profile - Upload an attachment in the attachment tab at the bottom of the page any image is fine - Clic...
pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in...