CVE-2021-3852

CVE-2021-3852 affects GROWI (WESEEK) and describes an authorization bypass through a user-controlled key. The connected sources specify an unauthenticated attacker could bypass authorization to delete arbitrary comments by abusing an endpoint such as /_api/comments.remove due to insufficient auth...

CVE-2021-3852 Authorization Bypass Through User-Controlled Key in weseek/growi

growi is vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2021-3852: Authorization Bypass Through User-Controlled Key

growi is vulnerable to Authorization Bypass Through User-Controlled Key...

PT-2022-10734

Name of the Vulnerable Software and Affected Versions growi affected versions not specified Description The issue is related to Authorization Bypass Through User-Controlled Key, which allows for unauthorized access. Recommendations At the moment, there is no information about a newer version that...

Weseek growi 安全漏洞

Weseek Growi is an open source wiki system that can be written in Markdown by the Japanese company Weseek. Weseek growi suffers from a security vulnerability that allows an attacker to bypass authorization with a user-controlled key...

CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

Cross site scripting

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

CVE-2021-20829

GROWI (WESEEK) has an XSS vulnerability (CVE-2021-20829) caused by inadequate tag sanitization in versions up to v4.2.19. An attacker can trigger a script in a user’s browser by loading a specially crafted page. The issue is documented across multiple sources (including Red Hat and NVD entries) a...

CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

PT-2021-14274

Name of the Vulnerable Software and Affected Versions: GROWI versions v4.2.19 and earlier Description: The issue is due to inadequate tag sanitization, allowing remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page. This enables the...

GROWI 及更早跨站脚本漏洞

Weseek Growi is an open source wiki system that can be written in Markdown by Weseek Japan. A security vulnerability in GROWI v4.2.19 and earlier versions, which stems from insufficient tag cleanup, allows remote attackers to execute arbitrary scripts on the web browsers of users accessing...

CVE-2021-20829: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

in weseek/growi

✍️ Description In following endpoint don't check the authorization of users and any user can delete other users comments /api/comments.remove the body of request is like this : "commentid" : "61393bb36970d0000c62b3cf" , "csrf" : any user receive all commentid and can easily replace other users...

CVE-2021-20736

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...

CVE-2021-20737

Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...

CVE-2021-20737

Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors...

CVE-2021-20736

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...

Sql injection

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors...