CVE-2024-41947

CVE-2024-41947 affects XWiki Platform. When a conflict arises while a user with higher rights is editing a page, it can allow execution of JavaScript on the other user’s browser, compromising confidentiality, integrity and availability of the installation. The issue has been patched in XWiki vers...

CVE-2024-41947 XWiki Platform XSS through conflict resolution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the...

CVE-2024-41947 XWiki Platform XSS through conflict resolution

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the...

GHSA-WF3X-JCCF-5G5G XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

Impact When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user...

CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or an...

CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or an...

CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to their user profile or an...

CVE-2024-37901

CVE-2024-37901 affects XWiki Platform. Any user with edit rights on any page can trigger arbitrary remote code execution by adding instances of the objects XWiki.SearchSuggestConfig and XWiki.SearchSuggestSourceClass to a profile or page, compromising confidentiality, integrity, and availability ...

CVE-2024-37900 XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a...

CVE-2024-37900 XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a...

CVE-2024-37900

XWiki Platform is affected by a cross-site scripting (XSS) vulnerability triggered by uploading an attachment with a malicious filename. Root cause: improper handling of attachment filenames during upload allows JavaScript execution in the uploader’s context. Affected versions: pre-14.10.21, pre-...

CVE-2024-37898

XWiki Platform (CVE-2024-37898) has a documented issue where a user with view but not delete rights can delete a page and replace it with new content, moving the old version to the recycle bin. Although the old content is not viewable due to rights transfer, the action results in the page being o...

CVE-2024-37898 XWiki Platform vulnerable to document deletion and overwrite from edit

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the pag...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that originates from allowing any user with editing privileges to execute arbitrary remote code by adding relevant instances to their user...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from improper management of user rights. The following versions are affected: versions 13.10.4 through 14.0-rc-1, 14.2 through...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from a conflict that can compromise the confidentiality, integrity, and availability of an entire XWiki installation by executing...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from improper handling of filenames when uploading attachments, allowing users to upload attachments with malicious filenames,...

PT-2024-5617 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6 Description: The issue is related to a lack of authorization in the XWiki Platform, allowing a remote attacker to...

PT-2024-29654 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 15.10.8 XWiki Platform versions prior to 16.3.0RC1 Description: The issue allows an attacker to execute JavaScript snippets on the side of another user, compromising the confidentiality, integrity, and...

PT-2024-27818 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.2 Description: The issue allows any user with edit rights on any page to perform arbitrary remote code execution by addin...