deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17451
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17452
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918, CWE-918
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17453
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17454
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17455
Published: 2023-04-15
Description: An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the "merge request approvals" feature.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639, CWE-639
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17536
Published: 2023-04-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2021-45464
Published: 2023-04-15
Description: kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. This allows a guest OS user to execute arbitrary code on the host machine.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cdn.discordapp.com/attachments/[PII_REDACTED]70164776/[PII_REDACTED]17230100/exploit.c; https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/commit/?id=39181fc6429f4e9e[PII_REDACTED]0e35857b42772a; https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/log/
CVE: CVE-2018-17537
Published: 2023-04-16
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2018-17883
Published: 2023-04-16
Description: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious link to an OTRS system or an agent. If a logged-in agent opens this link, it could cause the execution of JavaScript in the context of OTRS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.otrs.com/category/release-and-security-notes-en/; https://community.otrs.com/security-advisory-2018-06-security-update-for-otrs-framework/; https://community.otrs.com/category/release-and-security-notes-en/
CVE: CVE-2019-14942
Published: 2023-04-16
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Cookies for GitLab Pages (which have access control) could be sent over cleartext HTTP.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/; https://gitlab.com/gitlab-org/gitlab-pages/issues/232
CVE: CVE-2019-14944
Published: 2023-04-16
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77, CWE-77
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2019/08/12/critical-security-release-gitlab-12-dot-1-dot-6-released/; https://gitlab.com/gitlab-org/gitaly/issues/1801
CVE: CVE-2020-27545
Published: 2023-04-16
Description: libdwarf before 20201017 has a one-byte out-of-bounds read because of an invalid pointer dereference via an invalid line table in a crafted object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-763, CWE-763
References: http://web.archive.org/web/[PII_REDACTED]0703/https://sourceforge.net/projects/libdwarf/; https://bugzilla.redhat.com/show_bug.cgi?id=2025694; https://github.com/davea42/libdwarf-code/commit/95f634808c01f1c61bbec56ed2395af997f397ea
CVE: CVE-2020-28163
Published: 2023-04-16
Description: libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has an invalid FORM for a pathname.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://web.archive.org/web/[PII_REDACTED]0703/https://sourceforge.net/projects/libdwarf/; https://bugzilla.redhat.com/show_bug.cgi?id=2026000; https://github.com/davea42/libdwarf-code/commit/faf99408e3f9f706fc3809dd400e831f989778d3
CVE: CVE-2022-37704
Published: 2023-04-16
Description: Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-77
References: http://www.amanda.org/; https://github.com/MaherAzzouzi/CVE-2022-37704; https://github.com/zmanda/amanda/issues/192
CVE: CVE-2022-37705
Published: 2023-04-16
Description: A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-88
References: http://www.amanda.org/; https://github.com/MaherAzzouzi/CVE-2022-37705; https://github.com/zmanda/amanda/issues/192
CVE: CVE-2022-37186
Published: 2023-04-16
Description: In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-613, CWE-613
References: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
CVE: CVE-2022-37255
Published: 2023-04-16
Description: TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL[PII_REDACTED]03.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798, CWE-798
References: http://packetstormsecurity.com/files/171540/Tapo-C310-RTSP-Server-1.3.0-Unauthorized-Video-Stream-Access.html; https://www.tp-link.com/; http://packetstormsecurity.com/files/171540/Tapo-C310-RTSP-Server-1.3.0-Unauthorized-Video-Stream-Access.html
CVE: CVE-2022-37306
Published: 2023-04-16
Description: OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html; https://open-xchange.com; http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
CVE: CVE-2022-38840
Published: 2023-04-16
Description: cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html; https://drive.google.com/drive/folders/1UG5IcL8fFp9MV0vjd78_cx6iXKda5bpM?usp=sharing; http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html
CVE: CVE-2022-38841
Published: 2023-04-16
Description: Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/171433/Linksys-AX3200-1.1.00-Command-Injection.html; https://drive.google.com/drive/folders/1rAa4zzJPwMop0AEMiI2NKqUaZno7Ccqb?usp=sharing; http://packetstormsecurity.com/files/171433/Linksys-AX3200-1.1.00-Command-Injection.html
CVE: CVE-2022-40946
Published: 2023-04-16
Description: On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/webproc?getpage=html/index.html request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://packetstormsecurity.com/files/171484/D-Link-DIR-819-A1-Denial-Of-Service.html; https://github.com/whokilleddb/dlink-dir-819-dos; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2022-43128
Published: 2023-04-16
Description: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2022-42245. Reason: This record is a duplicate of CVE-2022-42245. Notes: All CVE users should reference CVE-2022-42245 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
CVE: CVE-2022-28353
Published: 2023-04-16
Description: In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://packetstormsecurity.com/files/171403/MyBB-External-Redirect-Warning-1.3-Cross-Site-Scripting.html; https://community.mybb.com/mods.php?action=view&pid=493; http://packetstormsecurity.com/files/171403/MyBB-External-Redirect-Warning-1.3-Cross-Site-Scripting.html
CVE: CVE-2022-30076
Published: 2023-04-16
Description: ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: http://packetstormsecurity.com/files/171777/ENTAB-ERP-1.0-Information-Disclosure.html; http://packetstormsecurity.com/files/171777/ENTAB-ERP-1.0-Information-Disclosure.html
CVE: CVE-2022-34125
Published: 2023-04-16
Description: front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://github.com/InfotelGLPI/cmdb/releases/tag/3.0.3; https://github.com/InfotelGLPI/cmdb/security/advisories/GHSA-wv59-3rv4-vm9f; https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE: CVE-2022-34126
Published: 2023-04-16
Description: The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/InfotelGLPI/activity/releases/tag/3.1.1; https://github.com/InfotelGLPI/activity/security/advisories/GHSA-jcmw-hpgh-357p; https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE: CVE-2022-34127
Published: 2023-04-16
Description: The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/InfotelGLPI/manageentities/releases/tag/4.0.2; https://github.com/InfotelGLPI/manageentities/security/advisories/GHSA-4hpg-m8fv-xv3h; https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE: CVE-2022-34128
Published: 2023-04-16
Description: The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://github.com/InfotelGLPI/positions/releases/tag/6.0.1; https://github.com/InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx; https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE: CVE-2021-33990
Published: 2023-04-16
Description: Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized user can upload a file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281, CWE-78
References: http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html; https://github.com/fu2x2000/Liferay_exploit_Poc; http://packetstormsecurity.com/files/171701/Liferay-Portal-6.2.5-Insecure-Permissions.html
CVE: CVE-2021-36520
Published: 2023-04-16
Description: A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/171731/itech-TrainSmart-r1044-SQL-Injection.html; https://sourceforge.net/p/trainsmart/code/HEAD/tree/code/; https://www.go2itech.org/resources/trainsmart/
CVE: CVE-2023-30772
Published: 2023-04-16
Description: The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.suse.com/show_bug.cgi?id=1210329; https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=06615d11cc78162dfd5116efb71f29eb29502d37
CVE: CVE-2022-48312
Published: 2023-04-16
Description: The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-787, CWE-125, CWE-787
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-29211
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights `WikiManager.DeleteWiki` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `wikiId` url parameter. The problem has been patched on XWiki  13.10.11, 14.4.7, and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/ba4c76265b0b8a5e2218be400d18f08393fe1428#diff-64f39f5f2cc8c6560a44e21a5cfd509ef00e8a2157cd9847c9940a2e08ea43d1R63-R64; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-w7v9-fc49-4qg4; https://jira.xwiki.org/browse/XWIKI-20297
CVE: CVE-2023-29212
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel. The problem has been patched on XWiki 14.4.7, and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a[PII_REDACTED]7e812a994419b69f#diff-a51a252f[PII_REDACTED]027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c5f4-p5wv-2475; https://jira.xwiki.org/browse/XWIKI-20293
CVE: CVE-2023-29214
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel. The problem has been patched on XWiki 14.4.7, and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qx9h-c5v6-ghqh; https://jira.xwiki.org/browse/XWIKI-20306
CVE: CVE-2023-29506
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jjm5-5v9v-7hx2; https://jira.xwiki.org/browse/XWIKI-20335
CVE: CVE-2023-29507
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-648
References: https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pwfv-3cvg-9m4c; https://jira.xwiki.org/browse/XWIKI-20380
CVE: CVE-2022-48313
Published: 2023-04-16
Description: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2022-48314
Published: 2023-04-16
Description: The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2023/4/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-202304-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2023/4/
CVE: CVE-2023-27610
Published: 2023-04-16
Description: Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/transbank-webpay-plus-rest/wordpress-transbank-webpay-rest-plugin-1-6-7-admin-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/transbank-webpay-plus-rest/wordpress-transbank-webpay-rest-plugin-1-6-7-admin-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2023-29508
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

CVSS Score: 8.9 (HIGH)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2; https://jira.xwiki.org/browse/XWIKI-20312; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hmm7-6ph9-8jf2
CVE: CVE-2023-29509
Published: 2023-04-16
Description: XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `documentTree` macro parameters in  This macro is installed by default in `FlamingoThemesCode.WebHome`. This page is installed by default. The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/80d5be36f700adcd56b6c8eb3ed8b973f62ec0ae; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f4v8-58f6-mwj4; https://jira.xwiki.org/browse/XWIKI-20279
CVE: CVE-2023-29511
Published: 2023-04-16
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit rights on a page (e.g., it's own user page), can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the section ids in `XWiki.AdminFieldsDisplaySheet`. This page is installed by default. The vulnerability has been patched in XWiki versions 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95
References: https://github.com/xwiki/xwiki-platform/commit/f1e310826a19acdcdecdecdcfe171d21f24d6ede; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rfh6-mg6h-h668; https://jira.xwiki.org/browse/XWIKI-20261