Directory traversal

Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package...

CVE-2012-0047

The CVE affects Apache Wicket 1.4.x, vulnerable to XSS via the wicket:pageMapName request parameter. The root cause is improper handling of this parameter, enabling remote script/HTML injection. Affected versions: 1.4.x prior to 1.4.20. The vulnerability is mitigated by upgrading to Apache Wicket...

CVE-2012-1089

CVE-2012-1089 affects Apache Wicket 1.4.x (before 1.4.20) and 1.5.x (before 1.5.5). A directory traversal flaw allows remote attackers to read arbitrary files by using a relative path in a URL for a Wicket resource that corresponds to a null package. The issue impacts web applications using vulne...

CVE-2012-1089

Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package...

CVE-2012-0047

Cross-site scripting XSS vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter...

Apache Wicket隐藏文件信息泄露漏洞

BUGTRAQ ID: 52679 CVE ID: CVE-2012-1089 Wicket 提供了一种面向对象的方式来开发基于 Web 的动态 UI 应用程序 Apache Wicket在实现上存在信息泄露漏洞，攻击者通过指定文件的相对路径，可被利用泄露任意文件内容 0 Apache Group Wicket 1.4.18 Apache Group Wicket 1.4.17 Apache Group Wicket 1.4.16 Apache Group Wicket 1.4.15 厂商补丁： Apache Group ------------...

Apache Wicket 'pageMapName'参数跨站脚本执行漏洞

BUGTRAQ ID: 52680 CVE ID: CVE-2012-0047 Wicket 提供了一种面向对象的方式来开发基于 Web 的动态 UI 应用程序。 Apache Wicket在操作‘wicket:pageMapName’请求参数值时可能存在XSS攻击，可被利用执行任意脚本代码。 0 Apache Group Wicket 1.4.18 Apache Group Wicket 1.4.17 Apache Group Wicket 1.4.16 Apache Group Wicket 1.4.15 厂商补丁： Apache Group ------------...

CVE-2011-2712

Cross-site scripting XSS vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2011-2712

CVE-2011-2712 is a cross-site scripting (XSS) vulnerability affecting Apache Wicket 1.4.x prior to 1.4.18 when setAutomaticMultiWindowSupport is enabled. The root cause is the application’s multi-window support configuration enabling injection of arbitrary JavaScript/HTML via unspecified paramete...

CVE-2011-2712

Cross-site scripting XSS vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

[CVE-2011-2712] Apache Wicket XSS vulnerability

Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.4.x Apache Wicket 1.3.x and 1.5-RCx are not affected Description: With multi window support application configuration and special query parameters it is possible to execute any kind of JavaScript on a si...