1685 matches found
CVE-2021-21379
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the wikimacrocontent executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inje...
CVE-2021-32731
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between and including versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a...
CVE-2021-32620
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for hi...
CVE-2021-32729
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script right...
CVE-2021-32730
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset th...
CVE-2021-29459
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information...
CVE-2021-32621
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been...
CVE-2021-21380
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform and only those with the Ratings API installed, the Rating Script Service expose an API to perform SQL requests without escaping the from and where search...
GHSA-RHFV-688C-P6HP XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
Impact In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which...
XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right
Impact In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are editing documents on which...
CVE-2025-48063
XWiki 16.10.0 is vulnerable: any user with edit rights on a document can set programming right as a required right. If a user with programming right later edits that document, the content gains programming right, enabling remote code execution. The issue is mitigated only by upgrading to 16.10.4 ...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform version 16.10.0, which stems from improperly set programming privileges and could lead to remote code execution...
The vulnerability of the org.xwiki.platform:xwiki-platform-component-wiki component of the XWiki Platform, a platform for creating collaborative web applications, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the org.xwiki.platform:xwiki-platform-component-wiki component of the XWiki Platform involves the absence of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the org.xwiki.platform:xwiki-platform-repository-rest-server component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows attackers to gain unauthorized access to protected information.
The vulnerability of the “org.xwiki.platform:xwiki-platform-repository-rest-server” component of the XWiki Platform relates to the absence of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the org.xwiki.platform:xwiki-platform-security-requiredrights-default component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to influence the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the org.xwiki.platform:xwiki-platform-security-requiredrights-default component of the XWiki Platform relates to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability could allow an attacker to influence the confidentiality, integrity, and...
The vulnerability of the org.xwiki.platform:xwiki-platform-security-authentication-ui component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to gain unauthorized access to protected information.
The vulnerability of the “org.xwiki.platform:xwiki-platform-security-authentication-ui” component of the XWiki Platform involves the absence of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the “org.xwiki.platform:xwiki-platform-wysiwyg-api” component of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information.
The vulnerability of the org.xwiki.platform:xwiki-platform-wysiwyg-api component of the XWiki Platform involves redirecting URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...
The vulnerability of the Message Stream module of the XWiki Platform, a platform for creating collaborative web applications. The XWiki Platform allows attackers to gain unauthorized access to protected information.
The vulnerability of the Message Stream module of the XWiki Platform, a platform for creating collaborative web applications, involves the disclosure of information in an unauthorized manner. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected informatio...
