CVE-2023-50339 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploi… |
CVE-2023-50332 | Medium | 6.5 | 2023-12-26 | Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a… |
CVE-2023-50294 | Medium | 6.5 | 2023-12-26 | The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for ext… |
CVE-2023-50175 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin… |
CVE-2023-49807 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrar… |
CVE-2023-49779 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script m… |
CVE-2023-49598 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, a… |
CVE-2023-49119 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script ma… |
CVE-2023-47215 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is e… |
CVE-2023-46699 | Medium | 4.3 | 2023-12-26 | Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page whil… |
CVE-2023-45740 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbit… |
CVE-2023-45737 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior… |
CVE-2023-42436 | Medium | 5.4 | 2023-12-26 | Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrar… |
CVE-2022-41799 | Medium | 6.5 | 2022-10-24 | Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to… |
CVE-2021-20829 | Medium | 6.1 | 2021-09-21 | Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary… |
CVE-2021-20737 | Medium | 6.5 | 2021-06-22 | Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without access privileges via… |
CVE-2021-20736 | Critical | 9.1 | 2021-06-22 | NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via uns… |
CVE-2021-20673 | Medium | 4.8 | 2021-03-10 | Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject a… |
CVE-2021-20672 | Medium | 6.1 | 2021-03-10 | Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 all… |
CVE-2021-20671 | High | 7.2 | 2021-03-10 | Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the ser… |
CVE-2021-20670 | High | 7.5 | 2021-03-10 | Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and… |
CVE-2021-20669 | Medium | 4.7 | 2021-03-10 | Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a sp… |
CVE-2021-20668 | Low | 2.7 | 2021-03-10 | Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafte… |
CVE-2021-20667 | Medium | 5.4 | 2021-03-10 | Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote auth… |
CVE-2021-20619 | Medium | 6.1 | 2021-01-19 | Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vector… |
CVE-2020-5683 | High | 7.5 | 2020-12-16 | Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earli… |
CVE-2020-5682 | High | 7.5 | 2020-12-16 | Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 series and earlier GROWI… |
CVE-2020-5678 | Medium | 6.1 | 2020-12-03 | Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. |
CVE-2020-5677 | Medium | 6.1 | 2020-12-03 | Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors. |
CVE-2020-5676 | High | 7.5 | 2020-12-03 | GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. |
CVE-2019-5969 | Medium | 6.1 | 2019-07-05 | Open redirect vulnerability in GROWI v3.4.6 and earlier allows remote attackersto redirect users to arbitrary web sites and conduct phishing attacks via the pr… |
CVE-2019-5968 | High | 8.8 | 2019-07-05 | Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authentication of administrators via updating… |
CVE-2018-16205 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal. |
CVE-2018-0698 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0655 | Medium | 4.8 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app setti… |
CVE-2018-0654 | Medium | 6.1 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki… |
CVE-2018-0653 | Medium | 6.1 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view. |
CVE-2018-0652 | Medium | 4.8 | 2018-09-07 | Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup… |