Xwiki
Page 2 of 3 — Xwiki CVEs from a corpus of 287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50723 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in… |
CVE-2023-50722 | Critical | 9.6 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, there is a reflected XSS or also direct remot… |
CVE-2023-50721 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface does… |
CVE-2023-50720 | Medium | 5.3 | 2023-12-15 | XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of u… |
CVE-2023-50719 | High | 7.5 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki di… |
CVE-2023-49280 | High | 7.7 | 2023-12-04 | XWiki Change Request is an XWiki application allowing to request changes on a wiki without publishing directly the changes. Change request allows to edit any p… |
CVE-2023-48293 | High | 8.8 | 2023-11-20 | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the… |
CVE-2023-48292 | Critical | 9.6 | 2023-11-20 | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request… |
CVE-2023-48241 | High | 7.5 | 2023-11-20 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search sugge… |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-46743 | High | 7.3 | 2023-11-09 | application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a docu… |
CVE-2023-46243 | Critical | 9.9 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execu… |
CVE-2023-46244 | Critical | 9.1 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write… |
CVE-2023-46242 | Critical | 9.6 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a conten… |
CVE-2023-38509 | Medium | 4.3 | 2023-11-07 | XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10… |
CVE-2023-46732 | Critical | 9.6 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting… |
CVE-2023-46731 | Critical | 10.0 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL paramete… |
CVE-2023-45137 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-45136 | Critical | 9.6 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name… |
CVE-2023-45135 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7… |
CVE-2023-45134 | Critical | 9.0 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. `org.xwiki.platform:xwiki-platform-web` starting in ve… |
CVE-2023-37913 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 and prior to versi… |
CVE-2023-37912 | Critical | 9.9 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of `org.xwiki.platfor… |
CVE-2023-37911 | Medium | 6.5 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and prior to versions 14… |
CVE-2023-37910 | High | 8.1 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move supp… |
CVE-2023-37909 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14… |
CVE-2023-37908 | Critical | 9.0 | 2023-10-25 | XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML render… |
CVE-2023-45144 | Critical | 10.0 | 2023-10-16 | com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in vi… |
CVE-2023-45138 | Critical | 10.0 | 2023-10-12 | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to vers… |
CVE-2023-41046 | Medium | 6.3 | 2023-09-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code witho… |
CVE-2023-40573 | Critical | 9.0 | 2023-08-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scri… |
CVE-2023-40572 | Critical | 9.0 | 2023-08-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The create action is vulnerable to a CSRF attack, allo… |
CVE-2023-40177 | Critical | 9.9 | 2023-08-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their… |
CVE-2023-40176 | Critical | 9.0 | 2023-08-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through t… |
CVE-2023-37914 | Critical | 9.9 | 2023-08-17 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.WebHome` can execute… |
CVE-2023-37462 | Critical | 9.9 | 2023-07-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkin… |
CVE-2023-37277 | Critical | 9.6 | 2023-07-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST req… |
CVE-2023-36477 | Critical | 9.0 | 2023-06-30 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights can edit all pages in the `C… |
CVE-2023-36470 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing docume… |
CVE-2023-36469 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notif… |
CVE-2023-36468 | Critical | 9.9 | 2023-06-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrad… |
CVE-2023-36471 | Critical | 9.0 | 2023-06-29 | Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and… |
CVE-2023-35162 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35161 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35160 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35159 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35158 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35157 | High | 8.4 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to perform an XSS by forging a request t… |
CVE-2023-35156 | Critical | 9.6 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35155 | High | 8.8 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing… |
CVE-2023-35153 | Critical | 9.0 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerabili… |
CVE-2023-35152 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous… |
CVE-2023-35151 | High | 7.5 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoin… |
CVE-2023-35150 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4… |
CVE-2023-34467 | High | 7.5 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation confi… |
CVE-2023-34466 | Medium | 4.3 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versi… |
CVE-2023-34465 | Critical | 9.9 | 2023-06-23 | XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by an… |
CVE-2023-34464 | Critical | 9.0 | 2023-06-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10… |
CVE-2023-35166 | Critical | 9.9 | 2023-06-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the rig… |
CVE-2023-32068 | Medium | 4.7 | 2023-05-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit… |
CVE-2023-32070 | Critical | 9.0 | 2023-05-10 | XWiki Platform is a generic wiki platform. Prior to version 14.6-rc-1, HTML rendering didn't check for dangerous attributes/attribute values. This allowed cros… |
CVE-2023-32071 | Critical | 9.0 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute… |
CVE-2023-32069 | Critical | 9.9 | 2023-05-09 | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute… |
CVE-2023-31126 | Critical | 9.0 | 2023-05-09 | `org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allow… |
CVE-2023-29528 | Critical | 9.0 | 2023-04-20 | XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in versi… |
CVE-2023-29527 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions a user without script or programm… |
CVE-2023-29526 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or inter… |
CVE-2023-29525 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Affected versions of xwiki are subject to code injecti… |
CVE-2023-29524 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute anything with the right of th… |
CVE-2023-29523 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile can execu… |
CVE-2023-29522 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary script… |
CVE-2023-29521 | High | 8.4 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy… |
CVE-2023-29520 | Medium | 4.3 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to break many translations coming from w… |
CVE-2023-29519 | Critical | 9.0 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A registered user can perform remote code execution le… |
CVE-2023-29518 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy… |
CVE-2023-29517 | High | 7.5 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The office document viewer macro was allowing anyone t… |
CVE-2023-29516 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on `XWiki.AttachmentSelector… |
CVE-2023-29515 | High | 7.7 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can create a space can become admin of th… |
CVE-2023-29514 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on any document (e.g., their… |
CVE-2023-29513 | Medium | 5.0 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible… |
CVE-2023-29512 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own us… |
CVE-2023-29510 | Critical | 9.9 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In XWiki, every user can add translations that are onl… |
CVE-2023-29213 | Critical | 9.0 | 2023-04-17 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of `org.xwiki.platform:xwiki-plat… |
CVE-2023-30537 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can… |
CVE-2023-29511 | Critical | 9.9 | 2023-04-16 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own us… |
CVE-2023-29509 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute… |
CVE-2023-29508 | High | 8.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Li… |
CVE-2023-29507 | Critical | 9.1 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to… |
CVE-2023-29506 | Medium | 5.4 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endp… |
CVE-2023-29214 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29212 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Veloc… |
CVE-2023-29211 | Critical | 9.9 | 2023-04-16 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrar… |
CVE-2023-29210 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29209 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including th… |
CVE-2023-29208 | High | 7.5 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. Rights added to a document are not taken into account for viewing it on… |
CVE-2023-29207 | High | 8.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The Livetable Macro wasn't properly sanitizing column names, thus allo… |
CVE-2023-29206 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet… |
CVE-2023-29205 | Critical | 9.9 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The HTML macro does not systematically perform a proper neutralization… |
CVE-2023-29204 | Medium | 4.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to… |
CVE-2023-29203 | Low | 3.7 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from sub… |