Apache Wicket vulnerable to CSRF attacks

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-6806 · ADVISORY
• apache/wicket · PACKAGE
• lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd@%3Cannounce.apache.org%3E · WEB
• lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E

org.apache.wicket:wicket-core のその他の脆弱性

• CVE-2026-43975中 6.5FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructi…
• CVE-2024-53299中 6.5The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server r…
• CVE-2021-23937高 7.5A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lo…
• CVE-2020-11976高 7.5By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sen…
• CVE-2014-3526高 7.5Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vec…