Weseek, Inc. Growi
34 CVEs affecting Weseek, Inc. Growi. Latest disclosed: 2023-12-26. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-20736 | Critical | 9.1 | 2021-06-22 | NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via uns… |
CVE-2019-5968 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating… |
CVE-2021-20670 | High | 7.5 | 2021-03-10 | Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and… |
CVE-2020-5683 | High | 7.5 | 2020-12-16 | Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earli… |
CVE-2020-5682 | High | 7.5 | 2020-12-16 | Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI… |
CVE-2020-5676 | High | 7.5 | 2020-12-03 | GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. |
CVE-2021-20671 | High | 7.2 | 2021-03-10 | Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the ser… |
CVE-2023-50332 | Medium | 6.5 | 2023-12-26 | Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a… |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2021-20737 | Medium | 6.5 | 2021-06-22 | Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via… |
CVE-2021-20829 | Medium | 6.1 | 2021-09-21 | Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary… |
CVE-2020-5678 | Medium | 6.1 | 2020-12-03 | Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. |
CVE-2020-5677 | Medium | 6.1 | 2020-12-03 | Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. |
CVE-2019-5969 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the pr… |
CVE-2018-0654 | Medium | 6.1 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki… |
CVE-2018-0653 | Medium | 6.1 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view. |
CVE-2023-50339 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploi… |
CVE-2023-50175 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin… |
CVE-2023-49807 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-49779 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script m… |