Xwiki
Page 3 of 3 — Xwiki CVEs from a corpus of 287, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29202 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The RSS macro that is bundled in XWiki included the content of the feed… |
CVE-2023-29201 | Critical | 9.0 | 2023-04-15 | XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in versi… |
CVE-2023-27480 | High | 7.7 | 2023-03-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a do… |
CVE-2023-27479 | Critical | 9.9 | 2023-03-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with view rights can exe… |
CVE-2023-26476 | High | 7.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResult… |
CVE-2023-26475 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context… |
CVE-2023-26474 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text a… |
CVE-2023-26473 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored… |
CVE-2023-26472 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by cre… |
CVE-2023-26471 | Critical | 9.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted m… |
CVE-2023-26470 | Medium | 5.7 | 2023-03-02 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusable by adding an o… |
CVE-2023-26056 | Medium | 5.4 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the… |
CVE-2023-26055 | Critical | 9.9 | 2023-03-02 | XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profil… |
CVE-2023-26480 | High | 8.9 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Liv… |
CVE-2023-26479 | Medium | 6.5 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 6.0, users with write rights can insert well-formed content that is not handled well by the pars… |
CVE-2023-26478 | Medium | 6.6 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment`… |
CVE-2023-26477 | Critical | 10.0 | 2023-03-02 | XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and… |
CVE-2023-22457 | Critical | 9.0 | 2023-01-04 | CKEditor Integration UI adds support for editing wiki pages using CKEditor. Prior to versions 1.64.3,t he `CKEditor.HTMLConverter` document lacked a protection… |
CVE-2022-41933 | Medium | 6.2 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-41935 | Medium | 5.3 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce t… |
CVE-2022-41934 | Critical | 9.9 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible docum… |
CVE-2022-41931 | Critical | 9.9 | 2022-11-23 | xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on co… |
CVE-2022-41930 | High | 7.5 | 2022-11-23 | org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWik… |
CVE-2022-41929 | Medium | 4.9 | 2022-11-23 | org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script r… |
CVE-2022-41928 | Critical | 9.9 | 2022-11-23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can al… |
CVE-2022-41927 | High | 7.4 | 2022-11-23 | XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The probl… |
CVE-2022-41937 | Critical | 9.6 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modi… |
CVE-2022-41936 | Medium | 5.3 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out… |
CVE-2022-39387 | Critical | 9.1 | 2022-11-04 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through… |
CVE-2022-36100 | Critical | 9.9 | 2022-09-08 | XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform… |
CVE-2022-36099 | Critical | 9.9 | 2022-09-08 | XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior… |
CVE-2022-36098 | High | 8.9 | 2022-09-08 | XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1… |
CVE-2022-36097 | High | 8.9 | 2022-09-08 | XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-r… |
CVE-2022-36096 | High | 8.9 | 2022-09-08 | The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior… |
CVE-2022-36095 | Medium | 4.3 | 2022-09-08 | XWiki Platform is a generic wiki platform. Prior to versions 13.10.5 and 14.3, it is possible to perform a Cross-Site Request Forgery (CSRF) attack for adding… |
CVE-2022-36094 | High | 8.9 | 2022-09-08 | XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 a… |
CVE-2022-36093 | High | 8.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template… |
CVE-2022-36092 | High | 7.5 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normall… |
CVE-2022-36091 | High | 7.5 | 2022-09-08 | XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects t… |
CVE-2022-36090 | High | 8.1 | 2022-09-08 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a c… |
CVE-2022-31167 | High | 7.1 | 2022-09-07 | XWiki Platform Security Parent POM contains the security APIs for XWiki Platform, a generic wiki platform. Starting with version 5.0 and prior to 12.10.11, 13… |
CVE-2022-31166 | High | 8.1 | 2022-09-07 | XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Starting in versions 11.3.7, 11.0.3, and 12.0RC1, it is possible to expl… |
CVE-2022-29258 | High | 7.4 | 2022-05-31 | XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Start… |
CVE-2022-29253 | Low | 2.7 | 2022-05-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with version 8.3-rc-1 and prior to versions 1… |
CVE-2022-29252 | High | 7.4 | 2022-05-25 | XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platform Wiki UI Main Wiki contains a possibl… |
CVE-2022-29251 | High | 7.4 | 2022-05-25 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possi… |
CVE-2022-29161 | Medium | 5.4 | 2022-05-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypto API will generate X509 certificates s… |
CVE-2022-24897 | High | 7.5 | 2022-05-02 | APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13… |
CVE-2022-24898 | Medium | 4.9 | 2022-04-28 | org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4… |
CVE-2022-24820 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24819 | Medium | 5.3 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wi… |
CVE-2022-24821 | Medium | 6.8 | 2022-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specifi… |
CVE-2022-23622 | High | 7.4 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (… |
CVE-2022-23621 | Medium | 5.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can re… |
CVE-2022-23620 | Medium | 6.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionH… |
CVE-2022-23619 | Medium | 5.3 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user… |
CVE-2022-23618 | Medium | 4.7 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against UR… |
CVE-2022-23617 | Medium | 6.5 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit right can copy… |
CVE-2022-23616 | High | 8.8 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged… |
CVE-2022-23615 | Medium | 5.4 | 2022-02-09 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can sa… |
CVE-2021-43841 | Medium | 5.4 | 2022-02-04 | XWiki is a generic wiki platform offering runtime services for applications built on top of it. When using default XWiki configuration, it's possible for an at… |
CVE-2021-32732 | High | 7.5 | 2022-02-04 | ### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tied to that email by… |
CVE-2021-32731 | Medium | 5.3 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the… |
CVE-2021-32730 | Medium | 5.7 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in v… |
CVE-2021-32729 | Low | 2.0 | 2021-07-01 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 1… |
CVE-2021-32621 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user withou… |
CVE-2021-32620 | High | 8.8 | 2021-05-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a… |
CVE-2021-29459 | Critical | 9.6 | 2021-04-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki… |
CVE-2021-21380 | High | 7.7 | 2021-03-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those… |
CVE-2021-21379 | High | 7.7 | 2021-03-12 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimac… |
CVE-2021-3137 | Medium | 5.4 | 2021-01-20 | XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section. |
CVE-2020-13654 | High | 7.5 | 2020-12-31 | XWiki Platform before 12.8 mishandles escaping in the property displayer. |
CVE-2020-15252 | High | 8.5 | 2020-10-16 | In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context wh… |
CVE-2020-15171 | Medium | 6.6 | 2020-09-10 | In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context… |
CVE-2020-11057 | Critical | 9.9 | 2020-05-12 | In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute python/groovy scripts while editing perso… |
CVE-2019-15302 | Medium | 6.5 | 2019-09-11 | The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to co… |
CVE-2018-16277 | Medium | 5.4 | 2018-09-28 | The Image Import function in XWiki through 10.7 has XSS. |
CVE-2017-1000051 | Medium | 6.1 | 2017-07-17 | Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via t… |
CVE-2012-1019 | | 2012-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWi… | |
CVE-2010-4642 | | 2010-12-30 | Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2010-4641 | | 2010-12-30 | SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |
CVE-2010-4640 | | 2010-12-30 | Multiple cross-site scripting (XSS) vulnerabilities in XWiki Watch 1.0 allow remote attackers to inject arbitrary web script or HTML via the rev parameter to (… | |
CVE-2007-4898 | | 2007-09-14 | Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki… | |
CVE-2007-4888 | | 2007-09-14 | The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a… | |
CVE-2006-7223 | | 2007-09-14 | PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote aut… | |
CVE-2005-4862 | | 2005-12-31 | The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string t… |