| CVE-2026-71378 |
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting…
|
Non notée
|
31 août 2026 |
| CVE-2026-71257 |
Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with…
|
Non notée
|
31 août 2026 |
| CVE-2026-70449 |
Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read…
|
Non notée
|
31 août 2026 |
| CVE-2026-66391 |
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket
|
Non notée
|
27 juil. 2026 |
| CVE-2026-66390 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
|
Non notée
|
27 juil. 2026 |
| CVE-2026-40010 |
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for…
|
Non notée
|
6 mai 2026 |
| CVE-2026-42509 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
|
Non notée
|
6 mai 2026 |
| CVE-2026-43646 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket
|
Non notée
|
6 mai 2026 |
| CVE-2026-43975 |
FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the…
|
Non notée
|
6 mai 2026 |
| CVE-2024-53299 |
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via…
|
Non notée
|
23 janv. 2025 |
| CVE-2024-36522 |
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when…
|
Non notée
|
12 juil. 2024 |
| CVE-2024-27439 |
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket
|
Non notée
|
19 mars 2024 |
| CVE-2021-23937 |
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to…
|
Non notée
|
25 mai 2021 |
| CVE-2014-0043 |
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for…
|
Non notée
|
2 oct. 2017 |
| CVE-2016-6806 |
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover…
|
Non notée
|
2 oct. 2017 |