CVE Vulnerability Catalog

Apache Wicket fails to enforce resource authorization (isResourceAuthorized() or the @AuthorizeResource annotation) in ResourceLink, Image, ImageButton and AjaxDownloadBehavior components when a resource is passed as an IResource instance. In that case the resource is served without the permission check, while the same control works when a ResourceReference is used. ExportToolbar is also affected because it builds its export links from IResource instances.

Apache Wicket has a missing authorization flaw that allows a component's listener to be invoked even when the authorization strategy denied the RENDER action for it. A crafted or even standard listener URL without a page identifier skips the render phase and Component#configure(), leaving the visibility flag at its constructor default. Components hidden or disabled in Component#onConfigure() are equally exposed.

The vulnerability in Apache Wicket is insufficient session expiration in native WebSocket support. A WebSocket connection keeps a copy of the HTTP session from when it was opened, so invalidating the session via the container (idle timeout, logout, filter invalidate) does not end the connection — subsequent frames still resolve the revoked identity and its attributes.

Apache Wicket fails to check authorization before invoking onMessage() callbacks in WebSocketBehavior. A client message is delivered to every WebSocketBehavior on the page, even when the component it is attached to is hidden, disabled, or denied by IAuthorizationStrategy — unlike Ajax behaviors, which perform this check.

Apache Wicket versions 10.3.0 through 10.11.0 contain a missing authorization vulnerability in form handling. The form resolves the submitting component from request parameters and passes it directly to onFormSubmitted(), skipping the visibility and enablement check. As a result, a request can invoke actions of a button or link that the application withheld.

Apache Wicket is missing authorization in its native WebSocket support. WebSocketMessageBroadcastHandler calls WebSocketResource#onPayload() directly without consulting IAuthorizationStrategy#isResourceAuthorized(), and the @AuthorizeResource annotation has no effect. A caller only needs a bound Wicket session and the resource name (exposed in the page that opens the connection) to reach all resource callbacks, including onConnect() and onMessage().

A vulnerability was identified in beecue FastBee up to version 2.1.0. An unknown functionality of the /iot/script file in the Groovy Script Executor component allows code injection. The attack can be carried out remotely, and a patch is available under identifier 890a33846005a937a58cccd738b7fb9821b82ea9.

A security flaw was discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P devices (version ESW_1.0(1)B1P48) in an unknown function of set_cloud_serverUrl.cgi, part of the Cloud Management component. Manipulating the url argument results in cross-site scripting (XSS). The attack can be launched remotely and the exploit has been publicly released.

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P devices (version ESW_1.0(1)B1P48) in an unknown function of httpupg.cgi, part of the local firmware upgrade interface. The manipulation leads to a buffer overflow. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was found in WAVLINK WN553X1-B (V260403_2.0.0) in the sub_419DA8 function of /bin/ioos, within the WireGuard CLI Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been made public.

A vulnerability has been found in WAVLINK WN553X1-B (260403_2.0.0) in the sub_4162A8 function of /bin/ioos, within the ovpn_file Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be executed remotely and the exploit has been disclosed to the public.

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58 in the isInterruptExpired function of sdks/typescript/packages/client/src/interrupts/index.ts, within the Interrupt expiry component. The manipulation causes resource consumption. Remote exploitation is possible and the exploit has been published.

Google::Auth versions 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, and the CLI exchanges it and stores the refresh token as the user's credentials.

Google::Auth version 0.12 for Perl allows server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. The Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without the host check applied by other credential classes.

A vulnerability was detected in ag-ui-protocol ag-ui up to version 0.0.58 in an unknown functionality of the Transport Decoder Handler component. The manipulation results in improper input validation. The attack may be launched remotely and the exploit is now public.

The WordPress File Upload plugin (Nickboss) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 5.2.1.

The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.

The Generative UI sandbox in prefab-ui runs caller-supplied Python inside Pyodide (WebAssembly) in a Deno subprocess, but from 0.14.0 through 0.20.2 Deno starts with unrestricted --allow-read, --allow-write, and --allow-net, and the Deno API remains on the JavaScript global object. This lets Python call Deno.readTextFileSync and Deno.writeTextFileSync, enabling file read/write as the server OS user and persistent code execution via a .pth file in site-packages.

In the ag-ui library (ag-ui-protocol) up to 0.0.58, the parseSSEStream function in sdks/typescript/packages/client/src/transform/sse.ts (SSE Parser component) allows excessive resource consumption. The attack can be launched remotely and the exploit has been publicly disclosed.