xwiki XWiki Platform

CVE-2023-29509 Critical 10.0 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability 76.2%
CVE-2023-29508 High 8.9 org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scripting 0.4%
CVE-2023-29507 Critical 9.1 org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors 0.9%
CVE-2023-29506 Medium 5.4 org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints 1.7%
CVE-2023-29214 Critical 10.0 org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability 1.2%
CVE-2023-29212 Critical 10.0 xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability 1.2%
CVE-2023-29211 Critical 10.0 org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability 1.2%
CVE-2023-29210 Critical 10.0 org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability 1.2%
CVE-2023-29209 Critical 10.0 org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability 1.1%
CVE-2023-29208 High 7.5 Data leak through deleted documents 0.9%
CVE-2023-29207 High 8.9 Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro 1.4%
CVE-2023-29206 Critical 9.1 org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins 0.9%
CVE-2023-29205 Critical 10.0 org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro 0.6%
CVE-2023-29204 Medium 4.7 URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore 1.8%
CVE-2023-29203 Low 3.7 Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm 0.7%
CVE-2023-29202 Critical 9.1 org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability 1.4%
CVE-2023-27480 High 7.7 Data leak through a XAR import XXE attack in xwiki-platform-xar-model 0.7%
CVE-2023-27479 Critical 10.0 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui 1.1%
CVE-2023-26056 Medium 5.4 XWiki Platform allows macro execution as any user without programming rights through the context macro 0.6%
CVE-2023-26470 Medium 5.7 In XWiki Platform, saving a document with a large object number leads to persistent OOM errors 0.9%
CVE-2023-26471 Critical 10.0 XWiki Platform users may execute anything with superadmin right through comments and async macro 0.9%
CVE-2023-26472 Critical 10.0 XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile 1.1%
CVE-2023-26473 Medium 6.5 XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm 0.6%
CVE-2023-26474 Critical 10.0 XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author 0.8%
CVE-2023-26475 Critical 10.0 XWiki Platform vulnerable to Remote Code Execution in Annotations 63.6%
CVE-2023-26476 High 7.5 Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor 2.2%
CVE-2023-26477 Critical 10.0 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability 74.8%
CVE-2023-26478 Medium 6.6 org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function 0.7%
CVE-2023-26479 Medium 6.5 org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions 1.1%
CVE-2023-26480 High 8.9 XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data 0.7%
CVE-2022-41934 Critical 9.9 Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui 1.4%
CVE-2022-41933 Medium 6.2 Plaintext storage of password in org.xwiki.platform:xwiki-platform-security-authentication-default 0.5%
CVE-2022-41932 High 7.5 Creation of new database tables through login form on PostgreSQL 0.6%
CVE-2022-41935 Medium 5.3 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui 0.9%
CVE-2022-41930 High 7.5 org.xwiki.platform:xwiki-platform-user-profile-ui missing authorization to enable or disable users 0.9%
CVE-2022-41929 Medium 4.9 Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore 0.8%
CVE-2022-41927 High 7.4 XWiki Platform vulnerable to Cross-Site Request Forgery (CSRF) allowing to delete or rename tags 0.3%
CVE-2022-41928 Critical 9.9 XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml 1.0%
CVE-2022-41931 Critical 9.9 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui 1.3%
CVE-2022-41936 Medium 5.3 Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server 0.8%
CVE-2022-41937 Critical 9.6 Missing Authorization in XWiki Platform 0.8%
CVE-2022-36100 Critical 9.9 XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection 73.6%
CVE-2022-36098 High 8.9 XWiki Platform Mentions UI vulnerable to Cross-site Scripting 71.6%
CVE-2022-36099 Critical 9.9 XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability 76.3%
CVE-2022-36097 High 8.9 XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form 58.2%
CVE-2022-36096 High 8.9 XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list 60.2%
CVE-2022-36095 Medium 4.3 XWiki Cross-Site Request Forgery (CSRF) for actions on tags 0.4%
CVE-2022-36094 High 8.9 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history 64.8%
CVE-2022-36093 High 8.5 XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard 0.9%
CVE-2022-36092 High 7.5 XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action 1.1%