CVE-2023-49807: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software package from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to 6.0.0, which stems from a stored cross-site scripting XSS vulnerability when processing MathJax...

PT-2023-29660 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.5.0 Description: A stored cross-site scripting issue exists in the App Settings /admin/app page and the Markdown Settings /admin/markdown page. If exploited, an arbitrary script may be executed on the web browser of...

PT-2023-30369 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting vulnerability exists, exploiting a behavior of the XSS Filter. If this issue is exploited, an arbitrary script may be executed on the web browser of the user who access...

PT-2023-31271 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the event handlers of the pre tags. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the...

PT-2023-31348 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting issue exists in the anchor tag of GROWI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

PT-2023-31533 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.1.11 Description: A stored cross-site scripting issue exists in the User Management page /admin/users of GROWI. This issue can lead to the execution of an arbitrary script on the web browser of the user who accessed...

CVE-2023-49119: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-50339: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-50294: Cleartext Storage of Sensitive Information

The App Settings /admin/app page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page...

CVE-2023-49779: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-45740: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

PT-2023-29661 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v4.1.3 Description: A stored cross-site scripting issue exists when processing profile images. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

PT-2023-28340 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v3.4.0 Description: A stored cross-site scripting issue exists in the presentation feature. If exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-49598: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-47215: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product...

CVE-2023-50332: Undefined Security Weakness

Improper authorization vulnerability exists in the User Management /admin/users page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI prior to version 6.0.0, which originates from a stored cross-site scripting XSS vulnerability in the App Settings /admin/app page...

Weseek GROWI Security Vulnerability

Weseek GROWI is a team collaboration software from Weseek Japan. A security vulnerability exists in Weseek GROWI versions prior to 6.0.6, which originates from a sensitive information disclosure vulnerability in the App Settings /admin/app page...

CVE-2023-50175: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting vulnerability exists in the App Settings /admin/app page, the Markdown Settings /admin/markdown page, and the Customize /admin/customize page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser o...