CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2010-4642
https://notcve.org/view.php?id=CVE-2010-4642
30 Dec 2010 — Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en XWiki Enterprise en versiones anteriores a la 2.5. Permite a usuarios remotos inyectar codigo de script web o código HTML de su elección a través de vectores sin especificar. • http://secunia.com/advisories/42058 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4898
https://notcve.org/view.php?id=CVE-2007-4898
14 Sep 2007 — Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative access to one wiki in a multiwiki environment, to obtain sensitive information via unknown attack vectors. NOTE: Some of these details are obtained from third party information. Vulnerabilidad no especificada en el plugin Multiwiki de XWiki versiones anteriores a 1.1 Enterprise RC2 permite a usuarios remotos autenticados, con acceso administrativo a un wiki en un entorn... • http://osvdb.org/40500 •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2006-7223
https://notcve.org/view.php?id=CVE-2006-7223
14 Sep 2007 — PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document. PreviewAction de XWiki 0.9.543 hasta 0.9.1252 no asigna al campo Author la identidad del usuario que modificó por último un documento... • http://jira.xwiki.org/jira/browse/XWIKI-366 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2007-4888
https://notcve.org/view.php?id=CVE-2007-4888
14 Sep 2007 — The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metadata regardless of a user's view rights, which allows remote authenticated users to read arbitrary documents via a custom skin that prints the content attribute of the doc variable. El gestor de error "No tienes permiso..." de XWiki 1.0 B1 y 1.0 B2 asocia la variable doc con el contenido entero del documento y sus metadatos a pesar de los derechos de visualizar del usuar... • http://jira.xwiki.org/jira/browse/XWIKI-726 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4862
https://notcve.org/view.php?id=CVE-2005-4862
31 Dec 2005 — The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string that matches a password. • http://jira.xwiki.org/jira/browse/XWIKI-70 • CWE-255: Credentials Management Errors •