Apache Wicket Sensitive Data Exposure

Description

References

• nvd.nist.gov/vuln/detail/CVE-2014-3526 · ADVISORY
• wicket.apache.org/news/2014/09/22/cve-2014-3526.html · WEB

More vulnerabilities in org.apache.wicket:wicket-core

• CVE-2026-43975MEDIUM 6.5FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructi…
• CVE-2024-53299MEDIUM 6.5The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server r…
• CVE-2021-23937HIGH 7.5A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lo…
• CVE-2020-11976HIGH 7.5By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sen…
• CVE-2016-6806HIGH 8.8Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin r…