maven

org.xwiki.platform:xwiki-platform-oldcore

46 Total advisories

46 Vulnerabilities

0 Malware

Dependency scanning

Check whether org.xwiki.platform:xwiki-platform-oldcore is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

org.xwiki.platform:xwiki-platform-oldcore

Vulnerabilities

XSS Cross Site Scripting

RCE in XWiki

Cross-site Scripting by SVG upload in xwiki-platform

Users with SCRIPT right can execute arbitrary code in XWiki

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

XWiki's REST APIs can list all pages/spaces, leading to unavailability

XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

Upgrading doesn't prevent exploiting vulnerable XWiki documents

XWiki allows SQL injection in query endpoint of REST API with Oracle

XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

XWiki leaks password hashes and other accessible password properties

XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

XWiki allows remote code execution through preview of XClass changes in AWM editor

org.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API

org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors

XWiki Platform allows remote code execution from user account

XWiki Platform allows XSS through XClass name in string properties

XWiki Platform vulnerable to document deletion and overwrite from edit

XWiki Platform remote code execution from account via custom skins support

XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted

XWiki Remote Code Execution

XWiki has no right protection on rollback action

XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action

XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token

Velocity execution without script right through VelocityCode and VelocityWiki property

XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action

org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents

XWiki Platform vulnerable to reflected cross-site scripting via delattachment action

org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability

XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode

XWiki Platform vulnerable to code injection in display method used in user profiles

org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents

org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability

XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author

XWiki Platform subject to Uncontrolled Resource Consumption

Creation of new database tables through login form on PostgreSQL

Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action

XWiki Platform Improper Authorization check for inactive users

XWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups

Path Traversal in XWiki Platform

Missing authorization in xwiki-platform

URL Redirection to Untrusted Site ('Open Redirect')

Missing authorization in xwiki-platform

Partial authorization bypass on document save in xwiki-platform

Browse more Maven advisories

Start Securing