org.xwiki.commons:xwiki-commons-xml

6 results · Feed

• Critical 9.1
  CVE-2023-36471 Public exploit

  HTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xml

  Xwiki commons is the common modules used by other XWiki top level projects. The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either cr…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Jun 29, 2023
• Critical 9.1
  CVE-2023-31126 Public exploit

  Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml

  `org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in version 14.6-rc-1, allows the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. Th…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  May 9, 2023
• Critical 9.1
  CVE-2023-29528 Public exploit

  Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml

  XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary H…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Apr 20, 2023
• Critical 9.1
  CVE-2023-29201 Public exploit

  org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability

  XWiki Commons are technical libraries common to several other top level XWiki projects. The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be us…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Apr 15, 2023
• Critical 10.0
  CVE-2023-26055

  XWiki Commons may allow privilege escalation to programming rights via user's first name

  XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The same vulnerability can …

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Mar 2, 2023
• Medium 4.9
  CVE-2022-24898

  Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

  org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki ap…

  xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  Apr 28, 2022