org.xwiki.platform:xwiki-platform-oldcore vulnerabilities (Maven)
46 vulnerabilities.
org.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+8.2 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki's REST APIs can list all pages/spaces, leading to unavailability6.9 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API8.6 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform: Password and email exposure in xml.vm fields8.7 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform: Any user with editing rights can access password properties through Database List Properties7.1 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform's searchDocuments API allows for SQL injection8.6 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki allows remote code execution through preview of XClass changes in AWM editor8.7 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki allows SQL injection in query endpoint of REST API with Oracle9.3 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenorg.xwiki.platform:xwiki-platform-oldcore allows SQL injection in short form select requests through the script query API8.6 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform allows XSS through XClass name in string properties9.1 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform vulnerable to document deletion and overwrite from edit4.3 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenDisabling a user account changes its author, allowing RCE from user account in XWiki9.1 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform remote code execution from account via custom skins support10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform: Privilege escalation (PR) from user registration through PDFClass10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted6.8 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki has no right protection on rollback action8.0 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenCode execution via the edit action in XWiki platform10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenCode injection in XWiki Platform9.7 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenorg.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents6.5 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenVelocity execution without script rights in Xwiki platform6.3 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action9.1 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenUpgrading doesn't prevent exploiting vulnerable XWiki documents10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform vulnerable to reflected cross-site scripting via delattachment action8.5 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenURL Redirection to Untrusted Site in XWiki4.7 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenCode injection in display method used in user profiles in xwiki-platform10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenAsync and display macro allow displaying and interacting with any document in restricted mode10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenURL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore4.7 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenorg.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors9.1 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenData leak through deleted documents7.5 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenIn XWiki Platform, saving a document with a large object number leads to persistent OOM errors5.7 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author10.0 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenCreation of new database tables through login form on PostgreSQL7.5 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenMissing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore4.9 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action7.5 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenorg.xwiki.platform:xwiki-platform-oldcore Improper Authorization check for inactive users8.1 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki.WebHome vulnerable to Improper Privilege Management in XWiki resolving groups8.1 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenPath Traversal in XWiki Platform2.7 Loworg.xwiki.platform:xwiki-platform-oldcoreMavenMissing authorization in xwiki-platform5.5 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenOpen Redirect in xwiki-platform4.7 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenMissing authorization in xwiki-platform6.5 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenPartial authorization bypass on document save in xwiki-platform5.4 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXSS by SVG upload in xwiki-platform5.4 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXSS Cross Site Scripting9.6 Criticalorg.xwiki.platform:xwiki-platform-oldcoreMavenRCE in XWiki8.5 Highorg.xwiki.platform:xwiki-platform-oldcoreMavenUsers with SCRIPT rights can execute arbitrary code in XWiki6.6 Mediumorg.xwiki.platform:xwiki-platform-oldcoreMavenXWiki Remote Code Execution6.5 Medium