CVE-2021-20672

The CVE-2021-20672 entry applies to GROWI (WESEEK) versions in the 4.2.x series, specifically 4.2.0–4.2.7. The underlying issue is insufficient verification/validation of URL query parameters, causing a reflected cross-site scripting (XSS) vulnerability. Attackers can inject arbitrary scripts tha...

CVE-2021-20670

The CVE-2021-20670 entry affects WESEEK GROWI up to version 4.2.2. It is an improper access control vulnerability that allows a remote, unauthenticated attacker to read a user’s personal information and/or the server’s internal information via unspecified vectors. Connected sources confirm GROWI ...

CVE-2021-20670

Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/or server's internal information via unspecified vectors...

CVE-2021-20669

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL...

CVE-2021-20669

GROWI (WESEEK) before version 4.2.20 is affected by CVE-2021-20669, a path traversal vulnerability. An attacker with administrator rights can read and/or delete arbitrary files by sending a specially crafted URL to GROWI 4.2.2 and earlier. The issue stems from improper path handling in requests, ...

CVE-2021-20668

CVE-2021-20668 concerns WESEEK/GROWI. Affected: GROWI 4.2.2 and earlier. Vulnerability: path traversal that allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL. Documented impact: attacker can read arbitrary files; remediation cited: update to a fixe...

CVE-2021-20668

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL...

CVE-2021-20667

GROWI web app (WESEEK) has a stored cross-site scripting vulnerability (CVE-2021-20667) caused by inadequate CSP configuration in v4.2.2 and earlier. A remote authenticated attacker can inject arbitrary scripts via crafted content, leading to script execution in a user’s browser. The issue affect...

Multiple cross-site scripting vulnerabilities in GROWI

Overview GROWI provided by WESEEK, Inc. contains multiple cross-site scripting vulnerabilities listed below. Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters CWE-79 - CVE-2021-20672 Stored cross-site scripting vulnerability in Admin Page CWE-79...

Weseek GROWI 跨站脚本漏洞

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A stored cross-site scripting vulnerability exists in the administrator page in GROWI 4.2.0 - 4.2.7. An attacker can exploit this vulnerability to execute arbitrary script in a logged-in user's web browser...

JVN#86438134: Multiple cross-site scripting vulnerabilities in GROWI

GROWI provided by WESEEK, Inc. contains multiple cross-site scripting vulnerabilities listed below. Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters CWE-79 - CVE-2021-20672 Version| Vector| Score ---|---|--- CVSS v3|...

Weseek GROWI 跨站脚本漏洞

Weseek GROWI is a suite of team collaboration software from Weseek Japan. A reflected cross-site scripting vulnerability exists in GROWI 4.2.0 - 4.2.7. The vulnerability stems from insufficient validation of URL query parameters. An attacker can exploit this vulnerability to execute arbitrary...

Weseek GROWI 路径遍历漏洞

GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read arbitrary paths via a specially crafted URL...

WESEEK GROWI path traversal vulnerability (CNVD-2021-16348)

GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read and/or delete arbitrary paths by sending a specially crafted request...

WESEEK GROWI Path Traversal Vulnerability

GROWI is a team collaboration software. A path traversal vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited to read arbitrary paths via a specially crafted URL...

Weseek GROWI 安全漏洞

GROWI is a team collaboration software. An access control error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by a remote, unauthenticated attacker to read a user's personal information and/or internal server information...

WESEEK GROWI Access Control Error Vulnerability

GROWI is a team collaboration software. An access control error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by a remote, unauthenticated attacker to read a user's personal information and/or internal server information...

Weseek GROWI 输入验证错误漏洞

GROWI is a team collaboration software. An input validation error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by remote attackers to overwrite files on the server with arbitrary code execution...

WESEEK GROWI cross-site scripting vulnerability (CNVD-2021-16350)

GROWI is a team collaboration software. A stored cross-site scripting vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by a remote attacker to execute arbitrary script in a user's browser by sending specially crafted content...

WESEEK GROWI Input Validation Error Vulnerability (CNVD-2021-16346)

GROWI is a team collaboration software. An input validation error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by remote attackers to overwrite files on the server with arbitrary code execution...