Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.xwiki.platform:xwiki-platform-attachment-ui

4 known vulnerabilities (3 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 critical, 1 high
Registry
Maven Central

Advisories 4

  • CVE-2023-29516Critical 9.9

    Code injection from view right on XWiki.AttachmentSelector in xwiki-platform

    Affected: from 2.0-rc-2, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.1.

  • CVE-2023-29519Critical 9.1

    Code injection in org.xwiki.platform:xwiki-platform-attachment-ui

    Affected: from 3.0-rc-1, fixed in 13.10.11; from 14.0-rc-1, fixed in 14.4.8; from 14.5, fixed in 14.10.2.

  • CVE-2022-41928Critical 9.9

    XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in…

    Affected: from 5.0-milestone-1, fixed in 13.10.7; from 14.0.0, fixed in 14.4.2.

  • XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

    Affected: from 14.0-rc-1, fixed in 14.4-rc-1.