| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script. |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion. |
| Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work. |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and trigger pairwise similar_text() comparisons, exhausting PHP CPU, memory, and database connections. |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources. |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out. |
| SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens. |
| SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens. |
| Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources. |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled. |
| Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers. |
| The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version
Vaadin 14.14.0 - 14.14.7
Vaadin 23.6.0 - 23.6.16
Vaadin 24.4.0 - 24.4.25
Vaadin 24.5.0 - 24.5.15
Vaadin 24.6.0 - 24.6.13
Vaadin 24.7.0 - 24.7.16
Vaadin 24.8.0 - 24.8.17
Vaadin 24.9.0 - 24.9.23
Vaadin 24.10.0 - 24.10.11
Vaadin 25.0.0 - 25.0.13
Vaadin 25.1.0 - 25.1.13
Vaadin 25.2.0 - 25.2.10
Vaadin 25.3.0 - 25.3.2
Vaadin Framework 7.1.0 - 7.7.54
Vaadin Framework 8.0.0 - 8.32.1
Mitigation
Upgrade to 14.14.8
Upgrade to 23.6.17
Upgrade to 24.4.26
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.7.17
Upgrade to 24.9.24
Upgrade to 24.9.24
Upgrade to 24.10.12
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.2.11
Upgrade to 25.3.3
Upgrade to 7.7.55
Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts
Maven coordinates / Vulnerable versions / Fixed version
com.vaadin:vaadin / 14.14.0 - 14.14.7 / >=14.14.8
com.vaadin:vaadin / 23.6.0 - 23.6.16 / >=23.6.17
com.vaadin:vaadin / 24.4.0 - 24.4.25 / >=24.4.26
com.vaadin:vaadin / 24.5.0 - 24.5.15 / >=24.7.17
com.vaadin:vaadin / 24.6.0 - 24.6.13 / >=24.7.17
com.vaadin:vaadin / 24.7.0 - 24.7.16 / >=24.7.17
com.vaadin:vaadin / 24.8.0 - 24.8.17 / >=24.9.24
com.vaadin:vaadin / 24.9.0 - 24.9.23 / >=24.9.24
com.vaadin:vaadin / 24.10.0 - 24.10.11 / >=24.10.12
com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.11
com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.11
com.vaadin:vaadin / 25.2.0 - 25.2.10 / >=25.2.11
com.vaadin:vaadin / 25.3.0 - 25.3.2 / >=25.3.3
com.vaadin:vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8
com.vaadin:vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17
com.vaadin:vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26
com.vaadin:vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17
com.vaadin:vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17
com.vaadin:vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17
com.vaadin:vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24
com.vaadin:vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24
com.vaadin:vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12
com.vaadin:vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11
com.vaadin:vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11
com.vaadin:vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11
com.vaadin:vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3
com.vaadin:flow-server / 2.13.0 - 2.13.7 / >=2.13.8
com.vaadin:flow-server / 23.6.0 - 23.6.15 / >=23.6.16
com.vaadin:flow-server / 24.4.0 - 24.4.18 / >=24.4.19
com.vaadin:flow-server / 24.5.0 - 24.5.17 / >=24.7.17
com.vaadin:flow-server / 24.6.0 - 24.6.14 / >=24.7.17
com.vaadin:flow-server / 24.7.0 - 24.7.15 / >=24.7.16
com.vaadin:flow-server / 24.8.0 - 24.8.16 / >=24.9.24
com.vaadin:flow-server / 24.9.0 - 24.9.28 / >=24.9.29
com.vaadin:flow-server / 24.10.0 - 24.10.14 / >=24.10.15
com.vaadin:flow-server / 25.0.0 - 25.0.15 / >=25.2.11
com.vaadin:flow-server / 25.1.0 - 25.1.18 / >=25.1.19
com.vaadin:flow-server / 25.2.0 - 25.2.12 / >=25.2.13
com.vaadin:flow-server / 25.3.0 - 25.3.3 / >=25.3.4
com.vaadin:vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55
com.vaadin:vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2
com.vaadin:vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55
com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2 |
| "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID. |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). |
| Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). |
| Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). |
| Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). |
| Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). |
