xwiki XWiki Platform

• CVE-2023-40177 Critical 9.9 XWiki Platform privilege escalation (PR) from account through AWM content fields 1.1%
• CVE-2023-40176 Critical 9.1 SXSS in the user profile via the timezone displayer 80.0%
• CVE-2023-37914 Critical 9.9 Privilege escalation (PR)/RCE from account through Invitation subject/message 1.9%
• CVE-2023-38509 Medium 4.3 XWiki Platform's obfuscated email addresses should not be sorted 0.8%
• CVE-2023-37462 Critical 10.0 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui 91.6%
• CVE-2023-37277 Critical 9.7 XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API 0.7%
• CVE-2023-36477 Critical 9.1 Persistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki Platform 0.9%
• CVE-2023-36468 Critical 10.0 Upgrading doesn't prevent exploiting vulnerable XWiki documents 1.9%
• CVE-2023-36469 Critical 10.0 Code injection through NotificationRSSService in XWiki Platform 82.0%
• CVE-2023-36470 Critical 10.0 Code injection in icon themes of XWiki Platform 1.9%
• CVE-2023-35162 Critical 9.7 XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template 2.4%
• CVE-2023-35161 Critical 9.7 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page 2.4%
• CVE-2023-35160 Critical 9.7 XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template 2.3%
• CVE-2023-35159 Critical 9.7 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template 2.2%
• CVE-2023-35158 Critical 9.7 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template 2.0%
• CVE-2023-35157 High 8.5 XWiki Platform vulnerable to reflected cross-site scripting via delattachment action 0.6%
• CVE-2023-35156 Critical 9.7 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template 2.1%
• CVE-2023-35155 High 8.8 XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email 1.5%
• CVE-2023-35153 Critical 9.1 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters 0.7%
• CVE-2023-35152 Critical 10.0 XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults 1.0%
• CVE-2023-35151 High 7.5 XWiki Platform may show email addresses in clear in REST results 0.7%
• CVE-2023-35150 Critical 9.9 XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application 77.7%
• CVE-2023-34467 High 7.5 XWiki Platform may retrieve email addresses of all users 1.0%
• CVE-2023-34466 Medium 4.3 XWiki Platform's tags on non-viewable pages can be revealed to users 0.6%
• CVE-2023-34465 Critical 10.0 XWiki Platform's Mail.MailConfig can be edited by any user with edit rights 0.9%
• CVE-2023-34464 Critical 9.1 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template 0.7%
• CVE-2023-35166 Critical 10.0 Privilege escalation (PR) from account through TipsPanel 62.2%
• CVE-2023-32068 Medium 4.7 URL Redirection to Untrusted Site in XWiki 53.8%
• CVE-2023-32071 Critical 9.1 XWiki Platform vulnerable to RXSS via editor parameter - importinline template 70.4%
• CVE-2023-32069 Critical 10.0 XWiki Platform privilege escalation (PR)/RCE from account through class sheet 0.8%
• CVE-2023-29517 High 7.5 Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer 1.0%
• CVE-2023-29516 Critical 9.9 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform 65.9%
• CVE-2023-29515 High 7.7 Cross-site scripting (XSS) in xwiki-platform 0.6%
• CVE-2023-29514 Critical 10.0 Code injection in template provider administration in xwiki-platform 1.9%
• CVE-2023-29513 Medium 5.0 Users can be created even when registration is disabled without validation via the template macro in xwiki-platform 0.7%
• CVE-2023-29512 Critical 9.9 Code injection in xwiki-platform-web-templates 1.1%
• CVE-2023-29510 Critical 10.0 Code injection via unescaped translations in xwiki-platform 1.9%
• CVE-2023-29522 Critical 9.9 Code injection from view right on XWiki.ClassSheet in xwiki-platform 1.9%
• CVE-2023-29521 High 8.4 Code injection from account/view through VFS Tree macro in xwiki-platform 1.1%
• CVE-2023-29520 Medium 4.3 Page render failure due to broken translations in xwiki-platform 0.5%
• CVE-2023-29519 Critical 9.1 Code injection in org.xwiki.platform:xwiki-platform-attachment-ui 1.9%
• CVE-2023-29518 Critical 9.9 Code injection from view right using Invitation.InvitationCommon in xwiki-platform 1.1%
• CVE-2023-29523 Critical 10.0 Code injection in display method used in user profiles in xwiki-platform 2.0%
• CVE-2023-29524 Critical 10.0 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform 75.7%
• CVE-2023-29525 Critical 10.0 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform 77.8%
• CVE-2023-29526 Critical 10.0 Async and display macro allow displaying and interacting with any document in restricted mode 1.1%
• CVE-2023-29527 Critical 10.0 Code injection from account through AWM view sheet in xwiki platform 1.1%
• CVE-2023-29213 Critical 9.1 org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerability 0.4%
• CVE-2023-29511 Critical 9.9 xwiki-platform-administration-ui vulnerable to privilege escalation 1.0%
• CVE-2023-30537 Critical 9.9 org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation 1.0%