Critical
CVE-2023-29525
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2023-29527
XWiki Platform vulnerable to code injection from account through AWM view sheet
Critical
CVE-2023-29526
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
Critical
CVE-2023-29524
XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
Critical
CVE-2023-29523
XWiki Platform vulnerable to code injection in display method used in user profiles
High
CVE-2023-29522
XWiki Platform vulnerable to code injection from view right on XWiki.ClassSheet
High
CVE-2023-29521
XWiki Platform vulnerable to code injection from account/view through VFS Tree macro
Medium
CVE-2023-29520
XWiki Platform vulnerable to page render failure due to broken translations
High
CVE-2023-29519
org.xwiki.platform:xwiki-platform-attachment-ui vulnerable to Code Injection
High
CVE-2023-29518
XWiki Platform vulnerable to privilege escalation from view right using Invitation.InvitationCommon
High
CVE-2023-29517
Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer
Critical
CVE-2023-29516
XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector
Medium
CVE-2023-29515
XWiki App Within Minutes app grants space admin rights that allows cross-site scripting
Critical
CVE-2023-29514
XWiki vulnerable to Code Injection in template provider administration
Medium
CVE-2023-29513
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro
Critical
CVE-2023-29512
xwiki-platform-web-templates vulnerable to Eval Injection
Critical
CVE-2023-20873
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
Medium
CVE-2023-28458
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
High
CVE-2023-28459
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.
Medium
CVE-2023-2142
Nunjucks autoescape bypass leads to cross site scripting
Medium
CVE-2023-27495
Bypass of CSRF protection in the presence of predictable userInfo
Critical
CVE-2023-29528
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml
Medium
CVE-2023-30548
Path traversal vulnerability in gatsby-plugin-sharp
Medium
CVE-2023-25601
Apache DolphinScheduler's python gateway suffered from improper authentication
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.