Apache Wicket: An attacker can intentionally trigger a memory leak

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-53299 · ADVISORY
• apache/wicket · PACKAGE
• lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5 · WEB
• wicket.apache.org/news/2025/01/31/wicket-8.17.0-released.html · WEB
• openwall.com/lists/oss-security/2025/01/22/12 · WEB

org.apache.wicket:wicket-core のその他の脆弱性

• CVE-2026-43975中 6.5FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructi…
• CVE-2021-23937高 7.5A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lo…
• CVE-2020-11976高 7.5By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sen…
• CVE-2014-3526高 7.5Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vec…
• CVE-2016-6806高 8.8Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin r…