Weseek

Growi

42 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2023-49598

  • EPSS 0.49%
  • Veröffentlicht 26.12.2023 08:15:10
  • Zuletzt bearbeitet 21.11.2024 08:33:37

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site usi...

5.4

CVE-2023-45737

  • EPSS 0.45%
  • Veröffentlicht 26.12.2023 08:15:09
  • Zuletzt bearbeitet 21.11.2024 08:27:16

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the ...

5.4

CVE-2023-42436

  • EPSS 0.45%
  • Veröffentlicht 26.12.2023 08:15:09
  • Zuletzt bearbeitet 21.11.2024 08:22:31

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the pro...

6.5

CVE-2022-41799

  • EPSS 0.1%
  • Veröffentlicht 24.10.2022 14:15:52
  • Zuletzt bearbeitet 07.05.2025 17:15:57

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by t...

6.5

CVE-2022-1236

  • EPSS 0.14%
  • Veröffentlicht 05.04.2022 09:15:07
  • Zuletzt bearbeitet 21.11.2024 06:40:19

Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

7.5

CVE-2021-3852

Exploit
  • EPSS 0.2%
  • Veröffentlicht 12.01.2022 11:15:08
  • Zuletzt bearbeitet 21.11.2024 06:22:39

growi is vulnerable to Authorization Bypass Through User-Controlled Key

6.1

CVE-2021-20829

  • EPSS 0.33%
  • Veröffentlicht 21.09.2021 10:15:07
  • Zuletzt bearbeitet 21.11.2024 05:47:14

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.

6.5

CVE-2021-20737

  • EPSS 0.26%
  • Veröffentlicht 22.06.2021 02:15:07
  • Zuletzt bearbeitet 21.11.2024 05:47:06

Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via unspecified vectors.

9.1

CVE-2021-20736

  • EPSS 0.35%
  • Veröffentlicht 22.06.2021 02:15:07
  • Zuletzt bearbeitet 21.11.2024 05:47:06

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.

4.8

CVE-2021-20673

  • EPSS 0.26%
  • Veröffentlicht 10.03.2021 10:15:13
  • Zuletzt bearbeitet 21.11.2024 05:46:59

Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.