CVE-2024-53299 Apache Wicket: An attacker can intentionally trigger a memory leak

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue...

CVE-2024-53299

The incident concerns CVE-2024-53299 in Apache Wicket. Affects the core of Apache Wicket 7.0.0 on any platform; the vulnerability enables an attacker to cause a denial of service by issuing multiple requests to server resources. The issue is mitigated by upgrading to non-7.x releases (recommended...

CVE-2024-53299 Apache Wicket: An attacker can intentionally trigger a memory leak

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue...

CVE-2024-53299 Apache Wicket: An attacker can intentionally trigger a memory leak

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue...

Apache Wicket 资源管理错误漏洞

Apache Wicket is the United States Apache Apache Foundation of a set of open source , lightweight , component-based framework , which provides an object-oriented way to develop Web-based dynamic UI applications . A resource management error vulnerability exists in Apache Wicket version 7.0.0. The...

PT-2024-35717 · Apache · Apache Wicket

Name of the Vulnerable Software and Affected Versions: Apache Wicket version 7.0.0 Apache Wicket versions prior to 9.19.0 Apache Wicket versions prior to 10.3.0 Description: The request handling in the core of Apache Wicket allows an attacker to create a denial of service DOS attack via multiple...

GHSA-HHWC-GH8H-9RRP Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue...

Apache Wicket Injection Vulnerability

Apache Wicket is a set of open source, lightweight, component-based frameworks from the Apache Foundation that provide an object-oriented approach to developing dynamic Web-based UI applications. Apache Wicket suffers from an injection vulnerability that stems from the default configuration of...

The vulnerability of the Java-based web application framework Apache Wicket, related to improper code generation management, allows attackers to gain unauthorized access to protected information, execute arbitrary code, and gain full control over the application.

The vulnerability of the Java-based web application framework Apache Wicket is related to improper code generation management. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information, execute arbitrary code, and gain full contr...

PT-2024-4004 · Apache · Apache Wicket

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions prior to 10.1.0 Apache Wicket versions prior to 9.18.0 Apache Wicket versions prior to 8.16.0 Description: The issue is related to incorrect code generation management in the Apache Wicket framework, allowing a remote...

The vulnerability of the Java-based web application framework Apache Wicket, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.

The vulnerability of the Java-based web application framework Apache Wicket relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created web page...

Cross-Site Request Forgery (CSRF)

Apache Wicket is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is caused due to an error in the evaluation of the fetch metadata headers within FetchMetadataResourceIsolationPolicy.java. This allows an attacker to bypass the Cross-Site Request Forgery CSRF protection mechanism...

CVE-2024-27439

A flaw was found in Apache Wicket. Under certain circumstances, this flaw allows an attacker to bypass Cross-Site Request Forgery CSRF protections...

GHSA-8VVP-525H-CXF9 Cross-Site Request Forgery in Apache Wicket

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...

Cross-Site Request Forgery in Apache Wicket

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...

CVE-2024-27439

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...

CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...