Filtered by vendor Xwiki
Subscriptions
Total
192 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-29459 | 1 Xwiki | 1 Xwiki | 2021-04-29 | 6.1 Medium |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. The vulnerability has been patched on XWiki 12.8 and 12.6.3. | ||||
| CVE-2021-21380 | 1 Xwiki | 1 Xwiki | 2021-03-24 | 8.8 High |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager. | ||||
| CVE-2021-21379 | 1 Xwiki | 1 Xwiki | 2021-03-22 | 5.4 Medium |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy. | ||||
| CVE-2021-3137 | 1 Xwiki | 1 Xwiki | 2021-01-22 | 5.4 Medium |
| XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section. | ||||
| CVE-2019-15302 | 1 Xwiki | 1 Cryptpad | 2020-08-24 | 6.5 Medium |
| The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification. | ||||
| CVE-2018-16277 | 1 Xwiki | 1 Xwiki | 2018-11-15 | N/A |
| The Image Import function in XWiki through 10.7 has XSS. | ||||
| CVE-2010-4642 | 1 Xwiki | 1 Xwiki | 2017-08-17 | N/A |
| Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2010-4641 | 1 Xwiki | 1 Xwiki | 2017-08-17 | N/A |
| SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | ||||
| CVE-2010-4640 | 1 Xwiki | 1 Xwiki Watch | 2017-08-17 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in XWiki Watch 1.0 allow remote attackers to inject arbitrary web script or HTML via the rev parameter to (1) bin/viewrev/Main/WebHome and (2) bin/view/Blog, and the (3) register_first_name and (4) register_last_name parameters to bin/register/XWiki/Register. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. | ||||
| CVE-2017-1000051 | 1 Xwiki | 1 Cryptpad | 2017-07-20 | N/A |
| Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the pad content | ||||
| CVE-2007-4888 | 1 Xwiki | 1 Xwiki | 2008-11-15 | N/A |
| The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable. | ||||
| CVE-2007-4898 | 1 Xwiki | 1 Xwiki | 2008-11-15 | N/A |
| Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from third party information. | ||||