CVSS: 6.1EPSS: 0%CPEs: -EXPL: 0CVE-2024-30878
https://notcve.org/view.php?id=CVE-2024-30878
A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the upload_drive parameter. • https://github.com/jianyan74/rageframe2/issues/111 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.6EPSS: 0%CPEs: -EXPL: 1CVE-2024-29399
https://notcve.org/view.php?id=CVE-2024-29399
An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component. • https://github.com/ally-petitt/CVE-2024-29399 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.9EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31997 – XWiki Platform remote code execution from account through UIExtension parameters
https://notcve.org/view.php?id=CVE-2024-31997
Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. ... This allows remote code execution and thereby impacts the confidentiality, integrity and availability of the whole XWiki installation. • https://github.com/xwiki/xwiki-platform/commit/171e7c7d0e56deaa7b3678657ae26ef95379b1ea https://github.com/xwiki/xwiki-platform/commit/1b2574eb966457ca4ef34e557376b8751d1be90d https://github.com/xwiki/xwiki-platform/commit/56748e154a9011f0d6239bec0823eaaeab6ec3f7 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-c2gg-4gq4-jv5j https://jira.xwiki.org/browse/XWIKI-21335 • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31996 – XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
https://notcve.org/view.php?id=CVE-2024-31996
Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, the HTML escaping of escaping tool that is used in XWiki doesn't escape `{`, which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. • https://github.com/xwiki/xwiki-commons/commit/b0805160ec7b01ee12417e79cb384e60ae4817aa https://github.com/xwiki/xwiki-commons/commit/b94142e2a66ec32e89eacab67c3da8d91f5ef93a https://github.com/xwiki/xwiki-commons/commit/ed7ff515a2436a1c6dcbd0c6ca0c41e434d58915 https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-hf43-47q4-fhq5 https://jira.xwiki.org/browse/XCOMMONS-2828 https://jira.xwiki.org/browse/XWIKI-21438 • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31988 – XWiki Platform CSRF remote code execution through the realtime HTML Converter API
https://notcve.org/view.php?id=CVE-2024-31988
Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, when the realtime editor is installed in XWiki, it allows arbitrary remote code execution with the interaction of an admin user with programming right. More precisely, by getting an admin user to either visit a crafted URL or to view an image with this URL that could be in a comment, the attacker can get the admin to execute arbitrary XWiki syntax including scripting macros with Groovy or Python code. • https://github.com/xwiki/xwiki-platform/commit/4896712ee6483da623f131be2e618f1f2b79cb8d https://github.com/xwiki/xwiki-platform/commit/9f8cc88497418750b09ce9fde5d67d840f038fbf https://github.com/xwiki/xwiki-platform/commit/d88da4572fb7d4f95e1f54bb0cce33fce3df08d9 https://github.com/xwiki/xwiki-platform/commit/d9f5043da289ff106f08e23576746fd8baf98794 https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5vh-gc3r-r24w https://jira.xwiki.org/browse/XWIKI-21424 • CWE-352: Cross-Site Request Forgery (CSRF) •