CVE-2022-29252

XWiki Platform Wiki UI Main Wiki contains a cross-site scripting vector in the WikiManager.JoinWiki page (field requestJoin) starting with version 5.3-milestone-2. The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3. A workaround is to edit WikiManager.JoinWiki using the wik...

CVE-2022-29253 Path Traversal in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patch...

CVE-2022-29253 Path Traversal in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patch...

CVE-2022-29253

The CVE-2022-29253 entries describe a path traversal in XWiki Platform. Affected versions are 8.3-rc-1 up to but not including 13.10.3 and 14.0 (i.e., versions prior to 12.10.3 and 14.0 are affected). The root cause is the template API allowing a path containing ".." to access files located in th...

CVE-2022-29253 Path Traversal in XWiki Platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 12.10.3 and 14.0, one can ask for any file located in the classloader using the template API and a path with ".." in it. The issue is patch...

Xwiki Platform 跨站脚本漏洞

Xwiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company Xwiki. A security vulnerability exists in XWiki Platform Flamingo Theme UI versions after 6.2.4, 6.3-rc-1, which stems from the presence of a cross-site scripting vector in the...

XWiki Platform 路径遍历漏洞

Xwiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company Xwiki. A security vulnerability exists in versions of XWiki Platform prior to 12.10.3 that stems from the ability to request any file located in the class loader using the template API...

Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API

Impact XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. Note that this API is never used in XWiki Standard but it might be used in some extension...

GHSA-H8V5-P258-PQF4 Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API

Impact XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1. Note that this API is never used in XWiki Standard but it might be used in some extension...

XWiki XSS Vulnerability

The Image Import function in XWiki through 10.7 has XSS...

GHSA-6MVR-CQ72-F66V XWiki XSS Vulnerability

The Image Import function in XWiki through 10.7 has XSS...

XWiki Cross-Site Scripting Vulnerability (CNVD-2022-72198)

Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...

XWiki Crypto API Vulnerability (GHSA-h8v5-p258-pqf4)

XWiki is prone to a vulnerability in the Crypto API. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

XWiki has unspecified vulnerabilities

Xwiki Platform is a set of wiki platforms for creating web collaboration applications from the French company Xwiki. security vulnerabilities exist in versions of XWiki prior to 13.10.6, 14.3.1 and 14.4-rc-1. X509 certificate with RSA, there is a risk of conflict with SHA1. No details of the...

CVE-2022-29161

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

Code injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

XWiki 加密问题漏洞

Xwiki Platform is a set of wiki platforms for creating web collaboration applications from the French company Xwiki. security vulnerabilities exist in versions of XWiki prior to 13.10.6, 14.3.1 and 14.4-rc-1. X509 certificate with RSA, there is a risk of conflict with SHA1. No details of the...

CVE-2022-29161 Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

CVE-2022-29161 Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collision...

CVE-2022-29161

CVE-2022-29161 concerns the XWiki Platform Crypto API generating X509 certificates signed by default with SHA-1 with RSA , a deprecated algorithm due to collision risks. The issue was patched in XWiki versions 13.10.6, 14.3.1 and 14.4-rc-1 , after which the API signs certificates with SHA-256 wit...