Apache Wicket insecure defaults

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2014-7808 · ADVISORY
• apache/wicket commit d2b8848 · WEB
• apache/wicket · PACKAGE
• lists.apache.org/thread/rqy6lpo5mzco85cbf65r53vdh87gz77b · WEB
• web.archive.org/web/20180830051017/https://www.smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html · WEB
• mail-archives.apache.org/mod_mbox/wicket-users/201502.mbox/%3CCAMomwMpLPDYezc=iFofm1R1Uq37vUFJ8VC-_ex5SU8-HAKBoRw%40mail.gmail.com%3E
• smrrd.de/cve-2014-7808-apache-wicket-csrf-2014.html · Third Party Advisory

org.apache.wicket:wicket-core のその他の脆弱性

• CVE-2026-43975中 6.5FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructi…
• CVE-2024-53299中 6.5The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server r…
• CVE-2021-23937高 7.5A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lo…
• CVE-2020-11976高 7.5By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sen…
• CVE-2014-3526高 7.5Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vec…