CVE-2020-5676

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5676

CVE-2020-5676 affects GROWI (WESEEK) v4.1.3 and earlier. It is described as an information-disclosure vulnerability where remote attackers may obtain information not allowed to access via unspecified vectors (CWE-200). The connected NVD/Veracode/Red Hat/JVN records corroborate the entry: informat...

PT-2020-18636

Name of the Vulnerable Software and Affected Versions GROWI versions 4.1.3 and earlier Description The issue allows remote attackers to obtain information that is not allowed to access via unspecified vectors. Recommendations For GROWI versions 4.1.3 and earlier, at the moment, there is no...

CVE-2020-5676: Exposure of Sensitive Information to an Unauthorized Actor

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors...

CVE-2020-5677: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

PT-2020-18638

Name of the Vulnerable Software and Affected Versions GROWI versions 3.8.1 and earlier Description The issue allows remote attackers to inject arbitrary script via unspecified vectors, which is a stored cross-site scripting vulnerability. Recommendations For GROWI versions 3.8.1 and earlier, at t...

CVE-2020-5678: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors...

PT-2020-18637

Name of the Vulnerable Software and Affected Versions GROWI versions 4.0.0 and earlier Description A reflected cross-site scripting issue allows remote attackers to inject arbitrary script via unspecified vectors. Recommendations For GROWI versions 4.0.0 and earlier, at the moment, there is no...

WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from WESEEK Weseek Japan. GROWI suffers from a cross-site scripting vulnerability that arises from insufficient validation of user-supplied data. An attacker could trick a victim into following a specially crafted link and execute...

WESEEK GROWI Information Disclosure Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from WESEEK Weseek Japan. An information disclosure vulnerability exists in GROWI versions 4.0.0 through 4.1.3, which stems from the application exporting too much data. The vulnerability allows a remote attacker to access potentially...

JVN#56450373: Multiple vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Information disclosure CWE-200 - CVE-2020-5676 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 5.3 CVSS v2| AV:N/AC:L/Au:N/C:P/I:N/A:N| Base Score: 5.0 Reflected...

WESEEK GROWI Cross-Site Scripting Vulnerability

Weseek WESEEK GROWI is a suite of team collaboration software from the Japanese company WESEEK Weseek. A cross-site scripting vulnerability exists in GROWI versions 3.0.2 through 3.8.1. The vulnerability stems from a failure to adequately validate user-supplied data during the processing of a POS...

Cross-Site Scripting (XSS)

growi is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

Cross-Site Scripting (XSS)

GROWI are vulnerable to cross-site scripting attacks. A remote, authenticated attacker could exploit the flawed New Page Handler component to inject and execute arbitrary web script or HTML into victim's browser...

CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

CVE-2019-13338

In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field...

Authentication flaw

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...