Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass object, and later an admin edits and saves that document, the possibly malicious content of that object is output as raw HTML, allowing XSS attacks. While the notification displayer executes Velocity, the existing generic analyzer already warns admins before editing Velocity code. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This vulnerability has been patched in XWiki 15.10.16, 16.4.7, and 16.10.2 by adding a required rights analyzer that warns the admin before editing about the possibly malicious code.

CVE-2025-49587 is a medium-severity vulnerability affecting the XWiki platform, an open-source wiki software widely used for collaborative documentation and knowledge management. The vulnerability arises due to insufficient user interface warnings when handling potentially dangerous operations involving the XWiki.Notifications.Code.NotificationDisplayerClass object. Specifically, if a user without script rights creates a document containing this object, and subsequently an administrator edits and saves that document, the content of the object can be rendered as raw HTML. This behavior enables cross-site scripting (XSS) attacks, as malicious HTML or script code embedded in the object can execute in the context of the administrator's browser. The vulnerability is tied to the way Velocity templates are executed within the notification displayer, but prior to version 15.9, there were no warnings to alert administrators about the risks of editing documents containing such potentially dangerous properties. Starting with XWiki 15.9, generic analyzers began warning admins before editing Velocity code, but warnings specifically for dangerous properties were only introduced in later versions. The issue has been addressed in patched releases 15.10.16, 16.4.7, and 16.10.2 by implementing a required rights analyzer that proactively warns administrators before editing documents that may contain malicious code. The affected versions span from 15.9-rc-1 up to but not including these patched versions. The CVSS 4.0 score of 6.4 reflects a medium severity, considering the network attack vector, low attack complexity, no privileges required for the initial malicious document creation, but requiring administrator interaction (UI) to trigger the exploit. No known exploits are currently reported in the wild. This vulnerability primarily impacts the confidentiality and integrity of administrative sessions by enabling XSS attacks, which could lead to session hijacking or unauthorized actions performed with admin privileges within the XWiki platform.

Detailed information about CVE-2025-49587: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform affecting xwiki xwiki-platform. Get 

CVE-2025-49587: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49587: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki (requires edit right), and that same document is later edited by a user with script, admin, or programming right, malicious code could be executed with the rights of the editing user without prior warning. In particular, this concerns custom display code, the script of computed properties and queries in database list properties. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.

CVE-2025-49585 is a high-severity vulnerability affecting multiple versions of the XWiki platform, a widely used generic wiki software. The vulnerability arises from insufficient user interface warnings regarding dangerous operations, specifically when creating and editing XClass definitions. In affected versions prior to 15.10.16, between 16.0.0-rc-1 and 16.4.6, and between 16.5.0-rc-1 and 16.10.1, an attacker with edit rights but without script or programming rights can create an XClass definition containing malicious code. When a user with elevated privileges (script, admin, or programming rights) subsequently edits the same document, the malicious code embedded in custom display code, computed properties scripts, or database list property queries can execute with the elevated user's privileges. This execution occurs without any prior warning to the privileged user, due to insufficient UI notifications about the potential danger of the operation. The vulnerability is categorized under CWE-357, which concerns insufficient UI warnings of dangerous operations. The issue was partially addressed by introducing warnings starting in version 15.9, but the full fix was implemented in versions 15.10.16, 16.4.7, and 16.10.2 by adding property analysis to detect and prevent execution of malicious code embedded in XClass properties. The CVSS 4.0 score of 8.6 reflects a high severity, with network attack vector, low attack complexity, no required privileges beyond edit rights, and user interaction required (the privileged user must edit the document). The impact on confidentiality, integrity, and availability is high due to the potential for arbitrary code execution with elevated privileges. No known exploits are currently reported in the wild, but the vulnerability presents a significant risk if weaponized.

Detailed information about CVE-2025-49585: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform affecting xwiki xwiki-platform. Get 

CVE-2025-49585: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49585: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform

XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as while these templates allow Velocity code, the existing generic analyzer already warns admins before editing Velocity code. The main impact would thus be to send spam, e.g., with phishing links to other users or to hide notifications about other attacks. Note that warnings before editing documents with dangerous properties have only been introduced in XWiki 15.9, before that version, this was a known issue and the advice was simply to be careful. This has been patched in XWiki 16.10.2, 16.4.7 and 15.10.16 by adding an analysis for the respective XClass properties.

CVE-2025-49583 is a medium-severity vulnerability affecting the XWiki platform, a widely used generic wiki software. The issue stems from a privilege context switching error (CWE-270) related to the handling of notification email templates. Specifically, when a user without script rights creates a document containing an object of the class `XWiki.Notifications.Code.NotificationEmailRendererClass`, the email templates embedded in this object are later used for notifications when an administrator edits and saves that document. Although these templates support Velocity scripting code, the platform's existing generic analyzer warns administrators before they edit any Velocity code, preventing direct execution of malicious scripts. The primary risk is that attackers could abuse this mechanism to send spam emails, potentially containing phishing links, or to conceal notifications about other attacks by manipulating notification content. This could facilitate social engineering attacks or reduce the visibility of ongoing compromises. The vulnerability affects XWiki versions prior to 15.10.16, versions between 16.0.0-rc-1 and 16.4.7, and versions between 16.5.0-rc-1 and 16.10.2. The issue was addressed in versions 15.10.16, 16.4.7, and 16.10.2 by implementing enhanced analysis of the relevant XClass properties to detect and block dangerous templates. Notably, warning prompts before editing documents with dangerous properties were introduced only in version 15.9; earlier versions lacked such safeguards, increasing risk. The CVSS 4.0 base score is 5.1 (medium), reflecting network exploitability without authentication but requiring some privilege (limited user rights) and user interaction (admin editing). No known exploits are reported in the wild as of publication. Overall, the vulnerability allows limited privilege escalation in the context of notification emails, primarily enabling spam or phishing campaigns rather than direct code execution or system compromise.

Detailed information about CVE-2025-49583: CWE-270: Privilege Context Switching Error in xwiki xwiki-platform affecting xwiki xwiki-platform. Get real-time upda

CVE-2025-49583: CWE-270: Privilege Context Switching Error in xwiki xwiki-platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49583: CWE-270: Privilege Context Switching Error in xwiki xwiki-platform

XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer rights, XWiki warns about the execution of these macros since XWiki 15.9RC1. These required rights analyzers that trigger these warnings are incomplete, allowing an attacker to hide malicious content. For most macros, the existing analyzers don't consider non-lowercase parameters. Further, most macro parameters that can contain XWiki syntax like titles of information boxes weren't analyzed at all. Similarly, the "source" parameters of the content and context macro weren't anylzed even though they could contain arbitrary XWiki syntax. In the worst case, this could allow a malicious to add malicious script macros including Groovy or Python macros to a page that are then executed after another user with programming righs edits the page, thus allowing remote code execution. The required rights analyzers have been made more robust and extended to cover those cases in XWiki 16.4.7, 16.10.3 and 17.0.0.

CVE-2025-49582 is a high-severity vulnerability affecting the XWiki platform, a widely used generic wiki software. The vulnerability stems from an incomplete implementation of protection mechanisms designed to prevent unauthorized execution of potentially dangerous macros authored by users with limited rights. Specifically, since XWiki version 15.9-rc1, the platform introduced warnings when editing content containing macros that could execute malicious scripts. However, the rights analyzers responsible for triggering these warnings are flawed. They fail to properly analyze macro parameters that are not in lowercase, and many parameters that can contain XWiki syntax—such as titles of information boxes or the "source" parameters of the content and context macros—are not analyzed at all. This oversight allows attackers to embed malicious script macros, including Groovy or Python scripts, into wiki pages. These malicious macros remain hidden until a user with programming rights edits the page, at which point the scripts execute, potentially leading to remote code execution (RCE). The vulnerability affects multiple versions of XWiki: from 15.9-rc1 up to but not including 16.4.7, from 16.5.0-rc1 up to but not including 16.10.3, and from 17.0.0-rc1 up to but not including 17.0.0. The issue was addressed in versions 16.4.7, 16.10.3, and 17.0.0 by enhancing the robustness and coverage of the rights analyzers. The CVSS 4.0 base score is 8.6, reflecting the network attack vector, low attack complexity, no privileges required, and user interaction needed, with high impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the potential for remote code execution makes this a critical concern for affected deployments.

Detailed information about CVE-2025-49582: CWE-693: Protection Mechanism Failure in xwiki xwiki-platform affecting xwiki xwiki-platform. Get real-time updates, 

CVE-2025-49582: CWE-693: Protection Mechanism Failure in xwiki xwiki-platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49582: CWE-357: Insufficient UI Warning of Dangerous Operations in xwiki xwiki-platform

Microsoft Edge (Chromium-based) Spoofing Vulnerability

CVE-2024-29057 is a medium-severity vulnerability affecting Microsoft Edge (Chromium-based) version 1.0.0. It is categorized under CWE-357, which refers to insufficient user interface (UI) warnings for dangerous operations. Specifically, this vulnerability allows for spoofing attacks where the browser's UI does not adequately warn users about potentially dangerous actions or content. This can lead to users being misled into performing actions they might otherwise avoid, such as entering sensitive information or executing commands under false pretenses. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium impact. The vector indicates that the attack can be executed remotely (AV:N), requires low attack complexity (AC:L), no privileges (PR:N), but does require user interaction (UI:R). The scope remains unchanged (S:U), and the impact affects integrity only (I:L), with no impact on confidentiality or availability. No known exploits are currently reported in the wild, and no patches have been published yet. The vulnerability is primarily a UI spoofing issue, meaning it manipulates the browser interface to deceive users rather than directly compromising system resources or data confidentiality. This type of vulnerability can be leveraged in phishing or social engineering attacks, increasing the risk of credential theft or unauthorized actions if users are tricked by the misleading UI elements.

Detailed information about CVE-2024-29057: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) affecting Micro

CVE-2024-29057: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-29057: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based)

CVE-2024-26188 is a medium-severity vulnerability identified in Microsoft Edge for Android (Chromium-based), specifically affecting version 1.0.0. The vulnerability is categorized under CWE-357, which relates to insufficient user interface warnings for dangerous operations. In this context, the flaw allows an attacker to perform spoofing attacks by misleading users through inadequate or missing UI indicators that would normally alert them to potentially harmful actions or content. This could involve deceptive visual elements or misleading prompts that fail to clearly communicate the risk, thereby tricking users into executing unintended operations. The vulnerability does not impact confidentiality or availability directly but affects the integrity of user interactions by enabling attackers to manipulate user perception and potentially cause users to perform actions that compromise their security or privacy. The CVSS 3.1 base score is 4.3 (medium), with the vector indicating that the attack can be performed remotely over the network (AV:N), requires no privileges (PR:N), but does require user interaction (UI:R). The attack complexity is low (AC:L), and the scope is unchanged (S:U). There are no known exploits in the wild at the time of publication, and no patches have been linked yet. The vulnerability's impact is limited to integrity, with no direct confidentiality or availability consequences. The lack of authentication requirements and low complexity make it feasible for attackers to exploit, but the necessity for user interaction reduces the overall risk. This vulnerability highlights the importance of clear and effective UI warnings in mobile browsers to prevent social engineering and spoofing attacks that could lead to further compromise or data manipulation.

Detailed information about CVE-2024-26188: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge for Android affecting Microsoft 

CVE-2024-26188: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge for Android - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-26188: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge for Android

Microsoft Edge for Android Spoofing Vulnerability

CVE-2024-21387 is a medium-severity vulnerability identified in Microsoft Edge (Chromium-based) specifically affecting the Android version (noted as version 1.0.0). The vulnerability is classified under CWE-357, which pertains to insufficient user interface (UI) warnings for dangerous operations. In this context, the flaw allows for spoofing attacks where the browser’s UI does not adequately warn users about potentially harmful or deceptive operations. This can lead to users being misled into interacting with malicious content or executing unintended actions without realizing the risk. The CVSS 3.1 base score is 5.3, reflecting a medium impact primarily due to the integrity loss without affecting confidentiality or availability. The attack vector is network-based (AV:N), requiring no privileges (PR:N) and no user interaction (UI:N), which means exploitation can occur remotely and automatically once the user visits a malicious or compromised web page. The scope remains unchanged (S:U), indicating the vulnerability affects only the vulnerable component without impacting other system components. The vulnerability does not compromise confidentiality or availability but can alter data integrity, potentially enabling attackers to spoof UI elements or manipulate browser behavior to deceive users. No known exploits are currently reported in the wild, and no patches have been linked yet, suggesting that mitigation and detection rely on awareness and cautious use of the affected browser version. Given that this vulnerability affects Microsoft Edge on Android, it targets mobile users who may be exposed to phishing or social engineering attacks facilitated by the spoofing capability. The lack of UI warnings increases the risk that users will be tricked into unsafe actions, such as entering credentials or approving transactions under false pretenses.

Detailed information about CVE-2024-21387: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) affecting Micro

CVE-2024-21387: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-21387: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based)

CVE-2024-21336 is a vulnerability identified in the Chromium-based Microsoft Edge browser, categorized under CWE-357, which pertains to insufficient user interface (UI) warnings for dangerous operations. This vulnerability allows for spoofing attacks where the browser's UI does not adequately alert users about potentially harmful actions or content. Specifically, the issue lies in the browser's failure to provide clear and sufficient warnings when users are about to perform operations that could compromise security or privacy. As a result, attackers could craft deceptive web content or manipulate browser elements to mislead users into executing actions they might otherwise avoid, such as submitting sensitive information or granting permissions. The vulnerability affects Microsoft Edge version 1.0.0, with no known exploits in the wild as of the publication date (January 26, 2024). The CVSS 3.1 base score is 2.5, indicating a low severity level. The vector string (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) shows that the attack requires local access (AV:L), high attack complexity (AC:H), no privileges (PR:N), and user interaction (UI:R). The impact is limited to a slight integrity compromise (I:L) without affecting confidentiality or availability. This means that while the vulnerability can cause some misleading UI behavior, it does not directly lead to data disclosure or system downtime. No patches or exploit code are currently available, and the vulnerability is primarily a UI design flaw rather than a direct code execution or memory corruption issue.

Detailed information about CVE-2024-21336: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) affecting Micro

CVE-2024-21336: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-21336: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based)

CVE-2024-30058 is a medium-severity vulnerability affecting Microsoft Edge (Chromium-based) version 1.0.0. The issue is classified under CWE-357, which pertains to insufficient user interface warnings for dangerous operations, and also relates to CWE-290, indicating potential authentication issues. Specifically, this vulnerability enables spoofing attacks by failing to adequately warn users when potentially dangerous operations are initiated within the browser. This lack of clear UI warnings can mislead users into trusting malicious content or actions, increasing the risk of social engineering attacks such as phishing or drive-by downloads. The vulnerability does not require any privileges (PR:N) and can be exploited remotely over the network (AV:N) with low attack complexity (AC:L). However, it requires user interaction (UI:R), meaning the victim must engage with the malicious content for exploitation to succeed. The impact affects confidentiality and integrity (C:L/I:L) but does not affect availability (A:N). No known exploits are currently in the wild, and no patches have been published yet. The vulnerability's scope is unchanged (S:U), indicating it affects only the vulnerable component without impacting other system components. The CVSS 3.1 base score is 5.4, reflecting a medium severity level. This vulnerability highlights a UI design flaw that could be leveraged by attackers to deceive users into performing unsafe actions, potentially leading to credential theft, data leakage, or unauthorized modifications within the browser context.

Detailed information about CVE-2024-30058: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) affecting Micro

CVE-2024-30058: CWE-357: Insufficient UI Warning of Dangerous Operations in Microsoft Microsoft Edge (Chromium-based) - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-357'

Filter Threats

Threats Tagged 'cwe-357'