Maven package
org.xwiki.platform/xwiki-platform-flamingo-theme-ui
pkg:maven/org.xwiki.platform/xwiki-platform-flamingo-theme-ui
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-30537 | — | >= 12.6.6, < 13.10.11 | 13.10.11 | Apr 16, 2023 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root ca | ||
| CVE-2023-29509 | — | >= 7.2-rc-1, < 13.10.11 | 13.10.11 | Apr 16, 2023 | XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is im | ||
| CVE-2023-26477 | — | >= 6.2.4, < 13.10.10 | 13.10.10 | Mar 2, 2023 | XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameter | ||
| CVE-2022-29251 | — | < 12.10.11 | 12.10.11 | May 25, 2022 | XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeNam |
- CVE-2023-30537Apr 16, 2023affected >= 12.6.6, < 13.10.11fixed 13.10.11
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with the right to add an object on a page can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root ca
- CVE-2023-29509Apr 16, 2023affected >= 7.2-rc-1, < 13.10.11fixed 13.10.11
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is im
- CVE-2023-26477Mar 2, 2023affected >= 6.2.4, < 13.10.10fixed 13.10.10
XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameter
- CVE-2022-29251May 25, 2022affected < 12.10.11fixed 12.10.11
XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeNam