PT-2022-23187 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 14.0-rc-1 through 14.4-rc-1 Description: The issue allows storing JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment. For example, an attachment with name .jp...

XWiki Platform 代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform versions prior to 13.10.6 and 14.4, which stems from the fact that if a user has a view, it is possible to use the...

PT-2022-23191 · Xwiki · Xwiki Platform Applications Tag +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Applications Tag versions 1.7 through 13.10.5 XWiki Platform Tag UI versions prior to 13.10.6 and 14.4 Description: The tags document Main.Tags in XWiki did not sanitize user inputs properly, allowing users with view rights on...

PT-2022-23183 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 XWiki Platform versions prior to 14.2 Description: The issue allows user accounts to be created even when user registration is disabled by passing a template of the distribution wizard to the xpart...

PT-2022-23188 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 12.5-rc-1 through 13.10.5 XWiki Platform versions 12.5-rc-1 through 14.3 Description: The XWiki Platform Mentions UI allows storing Javascript or groovy scripts in a mention, macro anchor, or reference field. The store...

XWiki Platform 跨站请求伪造漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A cross-site request forgery vulnerability exists in XWiki Platform versions prior to 13.10.5 and prior to 14.3, which stems from the ability to perform a cross-site request...

PT-2022-23186 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.6 and 14.3 Description: The XWiki Platform Index UI allows storing JavaScript that will be executed by anyone viewing the deleted attachments index with an attachment containing JavaScript in its name...

PT-2022-23189 · Xwiki · Xwiki Platform Wiki Ui Main Wiki

Name of the Vulnerable Software and Affected Versions: XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5 XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3 Description: It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity...

PT-2022-23184 · Xwiki · Xwiki +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Web Parent POM versions 1.0 through 13.10.5 XWiki Platform Web Parent POM versions 14.0-rc-1 through 14.3 Description: The issue allows storing JavaScript that will be executed by anyone viewing the history of an attachment...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in XWiki Platform versions prior to 13.10.5, prior to 14.3RC1, which stems from an incorrect authorization check...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that stems from a lack of authorization and the disclosure of personal information to unauthorized participants...

PT-2022-23185 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.5 and 14.3 Description: The issue allows for a Cross-Site Request Forgery CSRF attack, enabling the addition or removal of tags on XWiki pages. Recommendations: For versions prior to 13.10.5, update to...

PT-2022-23180 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki Platform Old Core versions prior to 13.1.0.5 and 14.3-rc-1 Description: The issue arises from missing checks for inactive users in XWiki, including the REST service, allowing a disabled user to enable themselves using a REST call. Some...

XWiki Platform 授权问题漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. An authorization issue vulnerability exists in XWiki Platform versions prior to 13.10.4, 14.2, and 14.2, which arises from a login operation that bypasses authentication...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A cross-site scripting vulnerability exists in XWiki Platform versions prior to 13.10.6 and prior to 14.4, which stems from the ability to store Javascript or groovy script in a...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in the XWiki Platform Attachment UI version 14.0-rc-1 and versions prior to 14.4-rc-1, which stems from the ability to store JavaScript in the nam...

XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in the XWiki Platform Web Parent POM prior to version 13.10.6 and prior to version 14.30-rc-1, which stems from the ability to store JavaScript th...

多款 XWiki Platform 产品代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in the XWiki Platform Tag UI versions prior to 13.10.6 and 14.4, which stems from the fact that the tag document "Main.Tags" is not properly cleaned up from...

CVE-2022-31167

XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13.10.1, and 13.4.6, a bug in the security cache stores rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entr...

CVE-2022-31166

XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to exploit a bug in XWikiRights resolution of groups to obtain privilege escalation. More specifically, editing a right with the object editor...