Skip to content
OpenAdvisories

Archive

8 September 2022

Vulnerabilities first published on this day (UTC), newest first.

← August 2022 2022 / September /8 October 2022 →
  1. 170
  2. 277
  3. 31
  4. 42
  5. 539
  6. 6157
  7. 764
  8. 858
  9. 9130
  10. 10 
  11. 119
  12. 1249
  13. 13201
  14. 1449
  15. 1589
  16. 16266
  17. 175
  18. 187
  19. 19122
  20. 2096
  21. 2196
  22. 2258
  23. 23203
  24. 247
  25. 253
  26. 26105
  27. 2733
  28. 2874
  29. 2935
  30. 3069
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 8.9
    CVE-2022-36098 EPSS 72%

    XWiki Platform Mentions UI vulnerable to Cross-site Scripting

    XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a men…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-mentions-ui Maven
  • High 8.9
    CVE-2022-36097 EPSS 58%

    XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

    XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be e…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-attachment-ui Maven
  • High 8.9
    CVE-2022-36096 EPSS 60%

    XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

    The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone vi…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-index-ui Maven
  • High 8.9
    CVE-2022-36094 EPSS 65%

    XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

    XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the histor…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web Maven
  • High 8.5
    CVE-2022-36093

    XWiki Platform Web Templates vulnerable to Unauthorized User Registration Through the Distribution Wizard

    XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any ema…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-templates org.xwiki.platform:xwiki-platform-web Maven
  • High 7.5
    CVE-2022-36092

    XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action

    XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and direct…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  • High 7.5
    CVE-2022-36091

    XWiki Platform Web Templates vulnerable to Missing Authorization and Exposure of Private Personal Information to an Unauthorized Actor

    XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This include…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-web-templates org.xwiki.platform:xwiki-platform-web Maven
  • High 8.1
    CVE-2022-36090

    org.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users

    XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 13.1.0.5 and 14.3-rc-1, some resources are missing a check for inactive (not yet activated or disabled) users in XWiki, including the REST service. This m…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore Maven
  • High 7.4
    CVE-2022-36085

    OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions

    Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated) `WithUnsafeBuiltins` function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — …

    open-policy-agent opa github.com/open-policy-agent/opa Go
  • High 7.5
    CVE-2022-20696

    Cisco SD-WAN vManage Software Unauthenticated Access to Messaging Services Vulnerability

    A vulnerability in the binding configuration of Cisco SD-WAN vManage Software containers could allow an unauthenticated, adjacent attacker who has access to the VPN0 logical network to also access the messaging service ports on an affected system. This vulner…

    Cisco Cisco SD-WAN vManage Network devices
  • High 7.5
    CVE-2022-28220

    STARTTLS command injection in Apache JAMES

    Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into…

    Apache Software Foundation Apache James org.apache.james:james-server Maven