Skip to content
OpenAdvisories

Archive

2 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /2 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-26055

    XWiki Commons may allow privilege escalation to programming rights via user's first name

    XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can …

    xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  • Critical 10.0
    CVE-2023-26471

    XWiki Platform users may execute anything with superadmin right through comments and async macro

    XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted …

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-rendering-async-macro Maven
  • Critical 10.0
    CVE-2023-26472

    XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile

    XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through th…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-icon-ui Maven
  • Critical 10.0
    CVE-2023-26474

    XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

    XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workaro…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-oldcore org.xwiki.platform:xwiki-platform-legacy-oldcore Maven
  • Critical 10.0
    CVE-2023-26475 EPSS 64%

    XWiki Platform vulnerable to Remote Code Execution in Annotations

    XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the docume…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-annotation-ui Maven
  • Critical 10.0
    CVE-2023-26477 EPSS 75%

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-flamingo-theme-ui Maven
  • Critical 9.8
    CVE-2021-3854

    SQLi in Glox Technology's Useroam Hotspot

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Glox Technology Useroam Hotspot allows SQL Injection. This issue affects Useroam Hotspot: before 5.1.0.15.

    Glox Technology Useroam Hotspot