CVE-2022-46907: Apache JSPWiki Cross-site scripting on several plugins

Severity: moderate Description: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Mitigation: Apache

[ANNOUNCE] Apache JSPWiki 2.12.0 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.12.0. This is the first release on the 2.12 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

CVE-2022-34158: Apache JSPWiki: User Group Privilege Escalation

Severity: critical Description: A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to

CVE-2022-28732: Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin

Severity: moderate Description: A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Mitigation: Apache JSPWiki

CVE-2022-28731: Apache JSPWiki CSRF in UserPreferences.jsp

Severity: critical Description: A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.

CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

Severity: moderate Description: A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages

CVE-2022-27166: Apache JSPWiki: XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2

Severity: moderate Description: A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim Credit: Issue was

[ANNOUNCE] Apache JSPWiki 2.11.3 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.3. This is the fourth release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.11.2 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.2. This is the third release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.1 Description A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to

[CVE-2022-24947] Apache JSPWiki CSRF Account Takeover

Severity Critical Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.1 Description Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Mitigation Apache JSPWiki users should upgrade to 2.11.2 or later.

[ANNOUNCE] Apache JSPWiki 2.11.1 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.1. This is the second release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.11.0 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0. This is the first release after eight milestones on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[CVE-2021-44140] Apache JSPWiki Arbitrary file deletion on logout

Severity Critical Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M8 Description Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance by using a carefuly crafted http request on logout, given that those files are reachable to the

[CVE-2021-40369] Apache JSPWiki Cross-site scripting vulnerability on Denounce plugin

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M8 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute

[ANNOUNCE] Apache JSPWiki 2.11.0.M8 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M8. This is the eighth release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[ANNOUNCE] Apache JSPWiki 2.11.0.M7 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M7. This is the seventh release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[ANNOUNCE] Apache JSPWiki 2.11.0.M6 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M6. This is the sixth release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[CVE-2019-12407] Apache JSPWiki Cross-site scripting vulnerability related to the remember parameter

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M4 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the

[CVE-2019-12404] Apache JSPWiki Cross-site scripting vulnerability on InfoContent.jsp

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M4 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in

[CVE-2019-10090] Apache JSPWiki Cross-site scripting vulnerability on plain editor

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M4 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript

[CVE-2019-10089] Apache JSPWiki Cross-site scripting vulnerability on WYSIWYG editor

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M4 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript

[CVE-2019-10087] Apache JSPWiki Cross-site scripting vulnerability in Page Revision History

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M4 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute

[ANNOUNCE] Apache JSPWiki 2.11.0.M5 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M5. This is the fifth release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[CVE-2019-10078] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M3 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, which could lead to session hijacking. Initial reporting indicated

[CVE-2019-10077] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M3 Description A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki, which could lead to session hijacking. Mitigation Apache JSPWiki users should upgrade to

[CVE-2019-10076] Apache JSPWiki Cross-site scripting vulnerability on Apache JSPWiki

Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M3 Description A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki, which could lead to session hijacking. Mitigation Apache JSPWiki users should

[ANNOUNCE] Apache JSPWiki 2.11.0.M4 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M4. This is the fourth release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[CVE-2019-0224] Apache JSPWiki Cross-site scripting vulnerability

Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Apache JSPWiki up to 2.11.0.M2 Description: A carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to

[CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure

Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache JSPWiki up to 2.11.0.M2 Description: A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki, which could be used by an attacker to obtain registered

[ANNOUNCE] Apache JSPWiki 2.11.0.M2 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M2. This is the second release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[ANNOUNCE] Apache JSPWiki 2.11.0.M1 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M1. This is the first release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki

[ANNOUNCE] Apache JSPWiki 2.10.5 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.10.5. This is the fifth release on the 2.10 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.10.4 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.10.4. This is the fourth release on the 2.10 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.10.2 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.10.2. This is the third release on the 2.10 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.10.1 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.10.1. This is the second release on the 2.10 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here:

[ANNOUNCE] Apache JSPWiki 2.10.0 released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.10.0. This is the 2.10.0 release of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: http://www.apache.org/dyn/closer.cgi/jspwiki/

[ANNOUNCE] Apache JSPWiki 2.9.1-incubating released

The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.9.1-incubating from the Apache Incubator. This is the second release of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard J2EE components. The release is available here: