WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor xwiki✕
Overview 212 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 23 EPSS ≥ 0.5
212matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 23EPSS ≥ 0.510.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 212 100.0%
Critical 108 50.9% High 59 27.8% Medium 44 20.8% Low 1 0.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 212 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 115 54.2% Forecast only 10 4.7% No public exploit 87 41.0%
split by peak 99 / year
No exploit published: 212 Low: 1Medium: 44High: 59Critical: 108 not blocked: 212 No public exploit: 87Forecast only: 10Proof of concept only: 115
20071 No exploit published1 Medium1 not blocked1 No public exploit1 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20190 20203 No exploit published3 High2 Medium1 not blocked3 Proof of concept only1 No public exploit2 20218 No exploit published8 Critical1 High3 Medium4 not blocked8 No public exploit8 202240 No exploit published40 Critical11 High19 Medium10 not blocked40 Proof of concept only18 Forecast only1 No public exploit21 202399 No exploit published99 Critical73 High16 Medium10 not blocked99 Proof of concept only61 Forecast only7 No public exploit31 202428 No exploit published28 Critical17 High3 Medium8 not blocked28 Proof of concept only14 Forecast only2 No public exploit12 202527 No exploit published27 Critical6 High14 Medium6 Low1 not blocked27 Proof of concept only20 No public exploit7 20265 No exploit published5 High2 Medium3 not blocked5 Proof of concept only1 No public exploit4
2008201020122014201620182020202220242026
212 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2021-32730 Medium 2021-07-01 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template.
CVE-2021-32729 Medium 2021-07-01 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading.
CVE-2021-32621 High 2021-05-28 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.
CVE-2021-32620 High 2021-05-28 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6.7, and 12.10.2, a user disabled on a wiki using email verification for registration canouldre-activate themself by using the activation link provided for his registration. The problem has been patched in the following versions of XWiki: 11.10.13, 12.6.7, 12.10.2, 13.0. It is possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.
CVE-2021-29459 Critical 2021-04-20 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible to persistently inject scripts in XWiki versions prior to 12.6.3 and 12.8. Unregistred users can fill simple text fields. Registered users can fill in their personal information and (if they have edit rights) fill the values of static lists using App Within Minutes. There is no easy workaround except upgrading XWiki. The vulnerability has been patched on XWiki 12.8 and 12.6.3.
CVE-2021-21379 High 2021-03-12 No exploit published No public exploit XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.
CVE-2021-3137 Medium 2021-01-20 No exploit published No public exploit XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
CVE-2020-13654 High 2020-12-31 No exploit published Proof of concept only XWiki Platform before 12.8 mishandles escaping in the property displayer.
CVE-2020-15252 High 2020-10-16 No exploit published No public exploit In XWiki before version 12.5 and 11.10.6, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. This is patched in XWiki 12.5 and XWiki 11.10.6.
CVE-2020-15171 Medium 2020-09-10 No exploit published No public exploit In XWiki before versions 11.10.5 or 12.2.1, any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. The only workaround is to give SCRIPT right only to trusted users.
CVE-2018-16277 Medium 2018-09-28 No exploit published No public exploit The Image Import function in XWiki through 10.7 has XSS.
CVE-2006-7223 Medium 2007-09-14 No exploit published No public exploit PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, which allows remote authenticated users without programming rights to execute arbitrary code by selecting a document whose author has programming rights, modifying this document to contain a script, and previewing without saving the document.
‹ prev page 3 of 3 next ›