Advisories · Technology
Apache Software Foundation Apache Wicket.
Every CVE that names Apache Software Foundation Apache Wicket among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.6 High
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.6 High
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
- Apache Software Foundation Apache Wicket
- CWE-693
- CVSS 7.4 High
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
- Apache Software Foundation Apache Wicket
- CWE-179
- CVSS 6.3 Medium
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
- Apache Software Foundation Apache Wicket
- Information disclosure
- CVSS 8.3 High
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
- Apache Software Foundation Apache Wicket
- Denial of service
- CVSS 8.3 High
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
- Apache Software Foundation Apache Wicket
- Denial of service
- CVSS 7.4 High
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
- Apache Software Foundation Apache Wicket
- CWE-116
- CVSS 7.4 High
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.6 High
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
- Apache Software Foundation Apache Wicket
- CWE-696
- CVSS 7.2 High
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
- Apache Software Foundation Apache Wicket
- Authentication bypass
- CVSS 6.3 Medium
Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
- Apache Software Foundation Apache Wicket
- Broken access control
- CVSS 6.9 Medium
Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
- Apache Software Foundation Apache Wicket
- Broken access control
- CVSS 2.3 Low
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
- Apache Software Foundation Apache Wicket
- Authentication bypass
- CVSS 2.3 Low
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
- Apache Software Foundation Apache Wicket
- Broken access control
- CVSS 6.9 Medium
Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
- Apache Software Foundation Apache Wicket
- Broken access control
- CVSS 6.3 Medium
Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
- Apache Software Foundation Apache Wicket
- Broken access control
- CVSS 6.1 Medium
Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in Palette via getAdditionalAttributes
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in Button via its model object
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
- Apache Software Foundation Apache Wicket
- Cross-site request forgery (CSRF)
- CVSS 7.5 High
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
- Apache Software Foundation Apache Wicket
- Denial of service
- CVSS 5.3 Medium
Apache Wicket: Path traversal in resource style/variation/locale
- Apache Software Foundation Apache Wicket
- Path traversal
- CVSS 6.5 Medium
Apache Wicket: leaked and missing CSP headers
- Apache Software Foundation Apache Wicket
- Weak cryptography or TLS
- CWE-693
- CVSS 6.1 Medium
Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)