Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:18:11 +0000 CVE-2024-52299 — The PDF viewer macro allows accessing any attachment without access right checks https://cve.radiocsirt.org/vuln/cve-2024-52299 <p><strong>Affected:</strong> xwikisas macro-pdfviewer, xwikisas macro_pdfviewer</p> <p>macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the &#34;key&#34; that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn&#39;t update the digest. This is fixed in 2.5.6.</p> <p><strong>Affected:</strong> xwikisas macro-pdfviewer, xwikisas macro_pdfviewer</p> <p>macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the &#34;key&#34; that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn&#39;t update the digest. This is fixed in 2.5.6.</p> https://cve.radiocsirt.org/vuln/cve-2024-52299