xwiki XWiki Platform

• CVE-2024-55662 Critical 10.0 XWiki allows remote code execution through the extension sheet 0.8%
• CVE-2024-46978 Medium 6.5 Missing checks for notification filter preferences editions in XWiki Platform 0.5%
• CVE-2024-46979 Medium 5.3 Data leak of notification filters of users in XWiki Platform 0.5%
• CVE-2024-45591 Medium 5.3 XWiki Platform document history including authors of any page exposed to unauthorized actors 3.4%
• CVE-2024-43400 Critical 9.1 XWiki Platform allows XSS through XClass name in string properties 0.5%
• CVE-2024-43401 Critical 9.1 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them 0.7%
• CVE-2024-41947 Critical 9.1 XWiki Platform XSS through conflict resolution 1.7%
• CVE-2024-37901 Critical 10.0 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet 1.1%
• CVE-2024-37900 Medium 6.4 XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader 15.8%
• CVE-2024-37898 Medium 4.3 XWiki Platform vulnerable to document deletion and overwrite from edit 0.4%
• CVE-2024-38369 Critical 10.0 XWiki programming rights may be inherited by inclusion 0.3%
• CVE-2024-37899 Critical 9.1 Disabling a user account changes its author, allowing RCE from user account in XWiki 0.7%
• CVE-2024-31997 Critical 10.0 XWiki Platform remote code execution from account through UIExtension parameters 73.9%
• CVE-2024-31988 Critical 9.7 XWiki Platform CSRF remote code execution through the realtime HTML Converter API 0.7%
• CVE-2024-31987 Critical 10.0 XWiki Platform remote code execution from account via custom skins support 1.4%
• CVE-2024-31986 Critical 9.1 XWiki Platform CSRF remote code execution through scheduler job's document reference 0.5%
• CVE-2024-31985 Medium 5.4 XWiki Platform CSRF in the job scheduler 0.3%
• CVE-2024-31984 Critical 10.0 XWiki Platform: Remote code execution through space title and Solr space facet 83.0%
• CVE-2024-31983 Critical 10.0 XWiki Platform: Remote code execution from edit in multilingual wikis via translations 1.4%
• CVE-2024-31982 Critical 10.0 XWiki Platform: Remote code execution as guest via DatabaseSearch 34.5%
• CVE-2024-31981 Critical 10.0 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass 1.4%
• CVE-2024-31465 Critical 10.0 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet 75.6%
• CVE-2024-31464 Medium 6.8 XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted 0.4%
• CVE-2024-21648 High 8.0 XWiki has no right protection on rollback action 0.5%
• CVE-2024-21651 High 7.5 XWiki Denial of Service attack through attachments 0.6%
• CVE-2024-21650 Critical 10.0 XWiki Remote Code Execution vulnerability via user registration 93.5%
• CVE-2023-50732 High 8.3 Velocity execution without script right through tree macro 0.5%
• CVE-2023-50723 Critical 10.0 XWiki Platform remote code execution/programming rights with configuration section from any user account 1.2%
• CVE-2023-50722 Critical 9.7 XWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass 0.7%
• CVE-2023-50721 Critical 10.0 XWiki Platform RCE from account through SearchAdmin 78.8%
• CVE-2023-50719 High 7.5 XWiki Platform Solr search discloses password hashes of all users 83.5%
• CVE-2023-50720 Medium 5.3 XWiki Platform Solr search discloses email addresses of users 59.1%
• CVE-2023-48241 High 7.5 XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service 72.8%
• CVE-2023-48240 Critical 9.1 XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery 0.7%
• CVE-2023-46243 Critical 10.0 Code execution via the edit action in XWiki platform 1.0%
• CVE-2023-46242 Critical 9.7 Code injection in XWiki Platform 0.4%
• CVE-2023-46244 Critical 9.1 Privilege escalation in Xwiki platform 0.8%
• CVE-2023-46731 Critical 10.0 Remote code execution through the section parameter in Administration as guest in XWiki Platform 88.5%
• CVE-2023-46732 Critical 9.7 Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform 2.2%
• CVE-2023-45137 Critical 9.1 XWiki Platform XSS with edit right in the create document form for existing pages 0.8%
• CVE-2023-45136 Critical 9.7 XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled 5.4%
• CVE-2023-45135 Critical 9.1 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title 1.9%
• CVE-2023-45134 Critical 9.1 XWiki Platform XSS vulnerability from account in the create page form via template provider 2.0%
• CVE-2023-37913 Critical 10.0 org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter 1.4%
• CVE-2023-37911 Medium 6.5 org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents 0.9%
• CVE-2023-37910 High 8.1 org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move 0.7%
• CVE-2023-37909 Critical 10.0 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet 1.9%
• CVE-2023-41046 Medium 6.3 Velocity execution without script rights in Xwiki platform 0.5%
• CVE-2023-40573 Critical 9.1 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution 1.1%
• CVE-2023-40572 Critical 9.1 XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action 0.6%