Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
weseek growi vulnerabilities and exploits
(subscribe to this query)
5.4
CVSSv3
CVE-2023-49779
Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Weseek Growi
5.4
CVSSv3
CVE-2023-49807
Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
Weseek Growi
6.5
CVSSv3
CVE-2023-50294
The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.
Weseek Growi
6.5
CVSSv3
CVE-2022-41799
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated malicious user to bypass access restriction and download the markdown data from the pages set to private by the other users.
Weseek Growi
6.5
CVSSv3
CVE-2022-1236
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
Weseek Growi
7.5
CVSSv3
CVE-2021-3852
growi is vulnerable to Authorization Bypass Through User-Controlled Key
Weseek Growi
6.1
CVSSv3
CVE-2021-20829
Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and previous versions allows remote malicious users to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.
Weseek Growi
9.1
CVSSv3
CVE-2021-20736
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to obtain and/or alter the information stored in the database via unspecified vectors.
Weseek Growi
6.5
CVSSv3
CVE-2021-20737
Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote malicious user to view the unauthorized pages without access privileges via unspecified vectors.
Weseek Growi
5.4
CVSSv3
CVE-2021-20667
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and previous versions allows remote authenticated malicious users to inject an arbitrary script via a specially crafted content.
Weseek Growi
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
cross-site scripting
CVE-2024-5158
XML external entity
CVE-2024-4262
CVE-2024-2036
CVE-2024-4985
CVE-2024-21791
remote attackers
CVE-2023-43208
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »