444 matches found
Growi vulnerable to improper access control
Overview GROWI provided by WESEEK, Inc. contains an improper access control vulnerability CWE-284. Kenta Yamamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A us...
JVN#00845253: Growi vulnerable to improper access control
GROWI provided by WESEEK, Inc. contains an improper access control vulnerability CWE-284. Impact A user who can login to the affected product may download the markdown data from the pages set to private by the other users. Solution Update the software Update the software to the following versions...
Weseek GROWI 安全漏洞
Weseek GROWI is a suite of team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI v5 series versions prior to v5.1.4 and v4 series versions prior to v4.5.25, which stems from an access restriction failure and can be exploited by an attacker to view...
Growi vulnerable to weak password requirements
Overview GROWI provided by WESEEK, Inc. contains a weak password requirements vulnerability CWE-521, CVE-2022-1236. 418sec first reported this vulnerability to JPCERT/CC, then JPCERT/CC contacted WSEEK, Inc. as a coordinator. After the coordination between 418sec and WESEEK, Inc. was completed,...
CVE-2022-1236
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0...
CVE-2022-1236
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0...
CVE-2022-1236 Weak Password Requirements in weseek/growi
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0...
CVE-2022-1236 Weak Password Requirements in weseek/growi
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0...
Growi 安全漏洞
Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. A security vulnerability exists in the GitHub repository weseek/growi prior to version 5.0.0, which stems from a low password requirement...
GROWI vulnerable to authorization bypass through user-controlled key
Overview GROWI provided by WESEEK, Inc. contains an authorization bypass through user-controlled key vulnerability CWE-639, CVE-2021-3852. huntr first reported this vulnerability to JPCERT/CC, then JPCERT/CC contacted WSEEK, Inc. as an intermediator. After the coordination between huntr and WESEE...
Privilege Escalation
growi is vulnerable to privilege escalation. The vulnerability exists due to a lack of sanitization of the correct author ID when submitting a comment...
CVE-2021-3852
growi is vulnerable to Authorization Bypass Through User-Controlled Key...
CVE-2021-3852
growi is vulnerable to Authorization Bypass Through User-Controlled Key...
CVE-2021-3852
growi is vulnerable to Authorization Bypass Through User-Controlled Key...
Authorization
growi is vulnerable to Authorization Bypass Through User-Controlled Key...
CVE-2021-3852 Authorization Bypass Through User-Controlled Key in weseek/growi
growi is vulnerable to Authorization Bypass Through User-Controlled Key...
CVE-2021-3852
CVE-2021-3852 affects GROWI (WESEEK) and describes an authorization bypass through a user-controlled key. The connected sources specify an unauthenticated attacker could bypass authorization to delete arbitrary comments by abusing an endpoint such as /_api/comments.remove due to insufficient auth...
Weseek growi 安全漏洞
Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. Weseek growi suffers from a security vulnerability that allows an attacker to bypass authorization with a user-controlled key...
CVE-2021-20829
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...
CVE-2021-20829
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...