xwiki XWiki Platform

• CVE-2022-36091 High 7.5 XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor 0.9%
• CVE-2022-36090 High 8.1 org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users 1.2%
• CVE-2022-31166 High 8.1 XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups 1.5%
• CVE-2022-31167 High 7.1 XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference 0.8%
• CVE-2022-29258 High 7.4 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform 1.0%
• CVE-2022-29251 High 7.4 Cross-site Scripting in the Flamingo theme manager 1.3%
• CVE-2022-29252 High 7.4 Cross-site Scripting in XWiki Platform Wiki UI Main Wiki 1.0%
• CVE-2022-29253 Low 2.7 Path Traversal in XWiki Platform 1.1%
• CVE-2022-29161 Medium 5.4 Crypto script service uses hashing algorithm SHA1 with RSA for certificate signature in xwiki-platform 0.4%
• CVE-2022-24820 Medium 5.3 Unauthenticated user can list hidden document from multiple velocity templates 1.0%
• CVE-2022-24819 Medium 5.3 Unauthenticated user can retrieve the list of users through uorgsuggest.vm 3.2%
• CVE-2022-24821 Medium 6.8 Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx 0.8%
• CVE-2022-23622 High 7.4 Cross site scripting in registration template in xwiki-platform 1.0%
• CVE-2022-23621 Medium 5.5 Missing authorization in xwiki-platform 0.9%
• CVE-2022-23620 Medium 6.8 Path traversal in xwiki-platform-skin-skinx 1.0%
• CVE-2022-23619 Medium 5.3 Information exposure in xwiki-platform 1.1%
• CVE-2022-23618 Medium 4.7 Open Redirect in xwiki-platform 0.8%
• CVE-2022-23617 Medium 6.5 Missing authorization in xwiki-platform 0.9%
• CVE-2022-23616 High 8.8 Remote code execution in xwiki-platform 2.1%
• CVE-2022-23615 Medium 5.4 Partial authorization bypass on document save in xwiki-platform 0.7%
• CVE-2021-43841 Medium 5.4 XSS by SVG upload in xwiki-platform 0.9%
• CVE-2021-32732 High 7.5 Cross-Site Request Forgery in xwiki-platform 1.0%
• CVE-2021-32731 Medium 5.3 The reset password form reveal users email address 1.2%
• CVE-2021-32730 Medium 5.7 No CSRF protection on the password change form 0.6%
• CVE-2021-32729 Low 2.0 A user without PR can reset user authentication failures information 0.5%
• CVE-2021-32620 High 8.8 Users registered with email verification can self re-activate their disabled accounts 1.1%
• CVE-2021-32621 High 8.8 Script injection without script or programming rights through Gadget titles 2.1%
• CVE-2021-29459 Critical 9.6 XSS Cross Site Scripting 1.1%
• CVE-2021-21380 High 7.7 Rating Script Service expose XWiki to SQL injection 1.3%
• CVE-2021-21379 High 7.7 It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro 0.5%
• CVE-2020-15252 High 8.5 RCE in XWiki 3.4%
• CVE-2020-15171 Medium 6.6 Users with SCRIPT rights can execute arbitrary code in XWiki 1.3%
• CVE-2020-11057 Critical 9.9 Code Injection in XWiki Platform 2.2%