CWE:

	Tytuł	Data	Autor
Med.	Intel Data Center Manager 5.1 Local Privilege Escalation	11.12.2022	Julien Ahrens

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-09-18

CVE-2024-46978

Updating...

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this. This vulnerability is present in XWiki since 13.2-rc-1. This vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters. Users are advised to upgrade. It's possible to fix manually the vulnerability by editing the document `XWiki.Notifications.Code.NotificationPreferenceService` to apply the changes performed in commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.

2024-02-13

CVE-2024-22042

Updating...

A vulnerability has been identified in Unicam FX (All versions). The windows installer agent used in affected product contains incorrect use of privileged APIs that trigger the Windows Console Host (conhost.exe) as a child process with SYSTEM privileges. This could be exploited by an attacker to perform a local privilege escalation attack.

2023-04-16

CVE-2023-29507

Updating...

XWiki Commons are technical libraries common to several other top level XWiki projects. The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

2023-04-11

CVE-2023-28062

Updating...

Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to bypass intended access restrictions and perform unauthorized actions.

2022-12-28

	CVE-2022-4805	Updating...	Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
	CVE-2022-4796	Updating...	Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

2022-12-23

CVE-2022-4687

Updating...

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.

2022-04-08

Medium

CVE-2022-24821

Vendor: Xwiki Software: Xwiki

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. There's no easy workaround for this issue, administrators should upgrade their wiki.

 

---

Copyright 2024, cxsecurity.com