CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16277
https://notcve.org/view.php?id=CVE-2018-16277
The Image Import function in XWiki through 10.7 has XSS. La función Image Import en XWiki hasta la versión 10.7 tiene Cross-Site Scripting (XSS). • https://mksec.tk/index.php/2018/09/27/cve-2018-16277-xss-in-xwiki • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2010-4642
https://notcve.org/view.php?id=CVE-2010-4642
Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en XWiki Enterprise en versiones anteriores a la 2.5. Permite a usuarios remotos inyectar codigo de script web o código HTML de su elección a través de vectores sin especificar. • http://secunia.com/advisories/42058 http://www.osvdb.org/68977 http://www.securityfocus.com/bid/44601 http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWikiEnterprise25 https://exchange.xforce.ibmcloud.com/vulnerabilities/62942 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2010-4641
https://notcve.org/view.php?id=CVE-2010-4641
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en XWiki Enterprise en versiones anteriores a la 2.5. Permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores sin especificar. • http://secunia.com/advisories/42058 http://www.osvdb.org/68976 http://www.securityfocus.com/bid/44601 http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWikiEnterprise25 https://exchange.xforce.ibmcloud.com/vulnerabilities/62943 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4898
https://notcve.org/view.php?id=CVE-2007-4898
Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from third party information. Vulnerabilidad no especificada en el plugin Multiwiki de XWiki versiones anteriores a 1.1 Enterprise RC2 permite a usuarios remotos autenticados, con acceso administrativo a un wiki en un entorno multiwiki, obtener información confidencial mediante vectores de ataque desconocidos. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://osvdb.org/40500 http://secunia.com/advisories/26777 http://www.securityfocus.com/bid/25647 http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise11RC2 •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2006-7223
https://notcve.org/view.php?id=CVE-2006-7223
PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document. PreviewAction de XWiki 0.9.543 hasta 0.9.1252 no asigna al campo Author la identidad del usuario que modificó por último un documento, lo cual permite a usuarios remotos autenticados sin derechos de programación ejecutar código de su elección seleccionando un documento cuyo autor tiene derechos de programación, modificando ese documento para que contenga un script, y previsualizándolo sin guardar el contenido. • http://jira.xwiki.org/jira/browse/XWIKI-366 • CWE-264: Permissions, Privileges, and Access Controls •