CVE-2023-46699

Cross-site request forgery CSRF vulnerability exists in the User settings /me page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention...

CVE-2023-45740

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-45740

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-45740

GROWI has a stored XSS vulnerability (CVE-2023-45740) when processing profile images in versions prior to 4.1.3. An arbitrary script could execute in a user’s browser when they view the affected site. The issue is confirmed across multiple sources and product advisories, with remediation by upgra...

CVE-2023-45737

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page and the Markdown Settings /admin/markdown page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using...

CVE-2023-45737

GROWI users are affected by a stored cross-site scripting vulnerability (CVE-2023-45737) in the App Settings (/admin/app) and Markdown Settings (/admin/markdown) pages for versions prior to the vendor-released fixes. The issue allows arbitrary script execution in a user’s browser when the vulnera...

CVE-2023-50339

Stored cross-site scripting vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-50339

GROWI is affected by a stored XSS on the User Management page (/admin/users) for versions prior to v6.1.11. The CVE-2023-50339 entry is corroborated across multiple sources (Red Hat CVE, OSV, PRION, JVN, CVE listings) with a consistent description: the vulnerability allows arbitrary script execut...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software package from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to 6.0.0, which stems from a stored cross-site scripting XSS vulnerability when processing MathJax...

PT-2023-31533 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.1.11 Description: A stored cross-site scripting issue exists in the User Management page /admin/users of GROWI. This issue can lead to the execution of an arbitrary script on the web browser of the user who accessed...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to 6.0.6, which originates from a sensitive information disclosure vulnerability in the App Settings /admin/app page...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI prior to version 6.0.0, which originates from a stored cross-site scripting XSS vulnerability in the App Settings /admin/app page...

PT-2023-29660 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.5.0 Description: A stored cross-site scripting issue exists in the App Settings /admin/app page and the Markdown Settings /admin/markdown page. If exploited, an arbitrary script may be executed on the web browser of...

PT-2023-31526 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.6 Description: The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret...

PT-2023-31271 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the event handlers of the pre tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the...

PT-2023-31059 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists via the img tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product. Recommendations...

PT-2023-30369 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting vulnerability exists, exploiting a behavior of the XSS Filter. If this issue is exploited, an arbitrary script may be executed on the web browser of the user who access...

PT-2023-31364 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists when processing MathJax. This could allow an arbitrary script to be executed on the user's web browser if the vulnerability is exploited. Recommendations:...

PT-2023-28340 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.4.0 Description: A stored cross-site scripting issue exists in the presentation feature. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI prior to version 6.0.6, which stems from an authorization error on the User Management /admin/users page that can be exploited by an attacker to delete or suspend his or her account...