Apache Software Foundation Wicket any version

Apache Wicket: Remote code execution via XSLT injection

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.

Apache Wicket: possible session fixation using AuthenticatedWebSession

DNS proxy and possible amplification attack

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.

Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed

Apache Wicket: crafted URLs can bypass PackageResourceGuard

Apache Wicket: An attacker can intentionally trigger a memory leak

Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager

Apache Wicket: Possible bypass of CSRF protection

Apache Wicket: leaked and missing CSP headers

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 might allow remote attackers to inject arbitrary web script or HTML via a ModalWindow title.

Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x before 7.2.0 allow remote attackers to inject arbitrary web script or HTML via a crafted "value" attribute in a <input> element.

Apache Wicket: crafted strings can break out of the JavaScript sequence

Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

Apache Wicket: XSS in Button via its model object

Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel

Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Apache Wicket: XSS in Palette via getAdditionalAttributes

Apache Wicket: Path traversal in resource style/variation/locale

Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener