René De Sain

Name of the Vulnerable Software and Affected Versions: XWiki versions 4.2-milestone-1 through 13.10.10 XWiki versions 14.4.0 through 14.4.6 XWiki versions 14.10.0 through 14.9.9 Description: XWiki Rendering is a system that converts textual input into different syntaxes. A flaw exists where the default macro content parser does not properly enforce restrictions when executing nested macros. This allows the execution of macros normally prohibited in restricted mode, specifically script macros. The cache and chart macros included with XWiki are affected by this issue. Recommendations: XWiki versions 4.2-milestone-1 through 13.10.10: Upgrade to version 13.10.11 or later. XWiki versions 14.4.0 through 14.4.6: Upgrade to version 14.4.7 or later. XWiki versions 14.10.0 through 14.9.9: Upgrade to version 14.10 or later. As a temporary measure, disable comments for untrusted users.

**Name of the Vulnerable Software and Affected Versions** Collabora Online versions prior to 22.05.13 Collabora Online versions prior to 21.11.9.1 Collabora Online versions prior to 6.4.27 **Description** A stored cross-site scripting (XSS) issue was found in Collabora Online. An attacker could create a document with an XSS payload as a document name. If an administrator opened the admin console and navigated to the history page, the document name was injected as unescaped HTML and executed as a script inside the context of the admin console. This could lead to the leak of the administrator JSON web token (JWT) used for the websocket connection. **Recommendations** For Collabora Online versions prior to 22.05.13, upgrade to Collabora Online 22.05.13 or higher to receive a patch. For Collabora Online versions prior to 21.11.9.1, upgrade to Collabora Online 21.11.9.1 or higher to receive a patch. For Collabora Online versions prior to 6.4.27, upgrade to Collabora Online 6.4.27 or higher to receive a patch.