macro-pdfviewer vulnerabilities
4 known vulnerabilities in macro-pdfviewer from Xwikisas. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.0 Critical severity
macro-pdfviewer: Improper Neutralization of Input During Web Page Generation
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole
- 7.5 High severity
macro-pdfviewer: Generation of Predictable Numbers or Identifiers
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the diges
- 7.5 High severity
macro-pdfviewer: Inclusion of Sensitive Information in Source Code Comments
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachme
- 7.7 High severity
macro-pdfviewer: Exposure of Sensitive Information to an Unauthorized Actor
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Users with edit rights can access restricted PDF attachments using the PDF Viewer macro, just by passing the attachment URL as the value of the ``file`` parameter. Users with view rights can