CVE-2023-50732

MEDIUM Year: 2023
CVSS v3 Score
6.3
Medium
Weakness Type
CWE-863
View all →

Vulnerability Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute a Velocity script without script right through the document tree. This has been patched in XWiki 14.10.7 and 15.2RC1.

Related Vulnerabilities

CVE-2016-9575

MEDIUM
CVSS:6.3(Medium)

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unp...

CWE-8632016

CVE-2017-6590

MEDIUM
CVSS:6.3(Medium)

An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login sc...

CWE-8632017

CVE-2018-1000152

MEDIUM
CVSS:6.3(Medium)

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapsho...

CWE-8632018

CVE-2019-19984

MEDIUM
CVSS:6.3(Medium)

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.

CWE-8632019

CVE-2020-12875

MEDIUM
CVSS:6.3(Medium)

Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating spec...

CWE-8632020

CVE-2020-26250

MEDIUM
CVSS:6.3(Medium)

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which sh...

CWE-8632020