Weseek, Inc. vulnerabilities
40 CVEs and advisories name Weseek, Inc. as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-42436Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0.
- CVE-2023-50332Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6.
- CVE-2023-50294The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form.
- CVE-2023-50175Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and th
- CVE-2023-49807Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0.
- CVE-2023-49779Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0.
- CVE-2023-49598Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0.
- CVE-2023-49119Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0.
- CVE-2023-47215Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0.
- CVE-2023-46699Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0.
- CVE-2023-45740Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3.
- CVE-2023-45737Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of G
- CVE-2023-50339Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11.
- CVE-2022-41799Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authent
- CVE-2022-1236Weak Password Requirements in weseek/growi
- CVE-2021-3852Authorization Bypass Through User-Controlled Key in weseek/growi
- CVE-2021-20829Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to e
- CVE-2021-20737Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without acc
- CVE-2021-20736NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in t
- CVE-2021-20673Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated at
- CVE-2021-20672Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v
- CVE-2021-20671Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite t
- CVE-2021-20670Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's perso
- CVE-2021-20669Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbi
- CVE-2021-20668Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via
- CVE-2021-20667Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier
- CVE-2021-20619Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via
- CVE-2020-5683Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI
- CVE-2020-5682Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 serie
- CVE-2020-5678Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vec