142385 matches found
CVE-2026-75802
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...
CVE-2026-71378
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...
CVE_2026_31694
CVE-2026-31694 パッシブスキャナ CVE-2026-31694 （LinuxカーネルのFUSE readdirキャッシュにおける領域外書き込み）向けのパッシブなLinuxホスト評価ツールです。 このスキャナは、実行中のカーネル、FUSEの露出状況、ローカルのパッケージメタデータ、カーネルソースの証跡、実行環境、OSファミリーを評価します。ホストが影響を受ける可能性がある場合、検出されたディストリビューションに合わせた緩和策ガイドを生成します。 作者: Aung Myat Thu w01f 目次 概要 脆弱性概要 セキュリティモデル 機能 要件 インストール 使用方法...
CVE-2025-57310
CVE-2025-57310 Salmen2/Simple-Faucet-Script v1.07 には、admin.php?p=ads&c=1 への巧妙に細工された POST リクエストによるクロスサイトリクエストフォージェリ CSRF の脆弱性が存在し、攻撃者が任意のコードを実行できる可能性があります。 CWE CWE-352: クロスサイトリクエストフォージェリ CSRF CVSS v3.1 基本値: 8.8 高 root@kitploit: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 概要...
CVE-2026-76983 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...
CVE-2026-76983
Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...
EUVD-2026-68491
Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...
CVE-2026-76983 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...
Ghostcat-CNVD-2020-10487
Ghostcat exp for CNVD-2020-10487CVE-2020-1938 Tomcat AJPプロトコルの任意の属性設定によるファイル読み取りとファイル実行。 脆弱性分析 コードはセキュリティテスト専用です。不正な目的で使用しないでください。生じた結果については使用者が責任を負い、筆者は一切関与しません！！！ root@kitploit: python3 ajpShooter.py -h /\ / \ | | | //\ | | ' \ \ | ' \ / \ / | / \ '| / | | | | \ \ | | | | | || / | / // | ./...
EUVD-2026-68488
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...
CVE-2026-75802
Apache Wicket (module wicket-extensions ) contains an XSS vulnerability in AjaxEditableLabel , AjaxEditableChoiceLabel , and AjaxEditableMultiLineLabel . The display value obtained from a non-null IChoiceRenderer, and the value returned by the overridden defaultNullLabel(), are written into the l...
CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...
CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...
CVE-2026-71378 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...
CVE-2026-71378 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...
CVE-2026-71378 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...
CVE-2026-71378
Apache Wicket 's ResourceIsolationRequestCycleListener (default policy: FetchMetadataResourceIsolationPolicy) contains a CSRF protection bypass affecting versions 9.1.0–9.23.0 and 10.0.0–10.10.0 . The policy inherited two unsafe allowances from a static-resource reference implementation: (1) all ...
EUVD-2026-68487
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone...