CVE Vulnerability Catalog

A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.

Apache Wicket generates JavaScript that references rendered elements, placing markup ids and form input names inside single-quoted JavaScript string literals without proper escaping. A value containing a single quote or backslash can terminate the literal and inject script that runs in the application's origin when the page loads. The issue affects wicket-core and wicket-extensions in versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0.

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly.

A cross-site scripting (XSS) vulnerability in Apache Wicket arises from improper neutralization of input during web page generation. The ExternalLink component, when bound to a non-anchor element, concatenates the model URL into a JavaScript string literal in the onclick attribute without proper escaping, allowing script execution in the application's origin.

Apache Wicket has an incorrect behavior order: a file path is validated by PackageResourceGuard before the framework appends the style, variation and locale attributes. As a result, the file opened may differ from the file approved by the guard, allowing disclosure of HTML markup templates of components whose class names contain an underscore (e.g. Report_v2).

In Apache Wicket, PackageResourceGuard incorrectly allows component markup templates to be served as package resources when wicket-core is loaded by a class loader that cannot see the application's classes. In such a setup the check for a class file beside the template fails, and a request for the package resource URL returns the component's markup template with status 200. Disclosed content is developer-authored template material such as component structure, comments, inline script, and named endpoints.

A vulnerability in Apache Wicket affects AbstractFileUploadResource, the server side of the form-less upload offered by FileUploadToResourceField. The request size, single-part size and part-count limits are taken from request parameters (maxSize, fileMaxSize, fileCountMax) instead of application configuration, so a client can raise or omit them. The resource carries no authorization annotation, so by default requests need no authentication.

A vulnerability in Apache Wicket affects the FileUploadToResourceField component, whose Ajax callback reads the filesInfo request parameter without binding it to an actual upload. The UploadInfo#get() method allocates a byte array based on the client-supplied size, allowing a single request to exhaust the JVM heap, while negative values trigger a NegativeArraySizeException.

A vulnerability in Apache Wicket affects the JavaScriptUtils#escapeQuotes() method, which fails to escape the backslash character before quotes. A value containing a backslash immediately before a quote results in the quote being left unescaped, closing the JavaScript string literal and allowing JavaScript injection. The issue occurs when an application uses this method to place attacker-influenced data inside a JavaScript string literal, including via the AjaxEditableLabel component.

Cross-site scripting (XSS) vulnerability in the SmartLinkLabel and SmartLinkMultiLineLabel components of Apache Wicket. These components turn URLs found in text into hyperlinks and accept any URL scheme, including script-executing schemes such as javascript:. Escaping the model value does not help because the payload ends up in the href attribute rather than in element text.

A cross-site scripting (XSS) vulnerability in Apache Wicket affects the AjaxNewWindowNotifyingBehavior, which stores the client-supplied window.name value in the page's serialized state. That value is later substituted without escaping into a single-quoted JavaScript string literal in the Ajax call precondition, allowing arbitrary script execution in the application's origin on every render of the page instance. Only applications that explicitly add this behavior to a component are affected.

A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. It affects an unknown part of the Find Command Handler component, where manipulation of the -exec argument results in OS command injection. The attack may be performed remotely.

Apache Wicket writes texts from resource bundles (labels, CSS class names) into generated JavaScript and markup without context-appropriate escaping. A text containing a quote can terminate the literal or attribute and be parsed as script or markup in the application's origin. Affected components include MultiFileUploadField, Form, UploadProgressBar, FilterForm and TrapFocusBehavior in versions 8.0.0–8.19.0, 9.0.0–9.24.0 and 10.0.0–10.11.0.

Apache Wicket performs security checks in the wrong order in ResourceIsolationRequestCycleListener: the target page is obtained before the resource isolation policies are consulted, because those policies are passed that page. As a result, RestartResponseAtInterceptPageException is thrown from inside the listener before any policy runs, so a cross-origin request is not refused. The stored destination URL, including its query string, is later used after sign-in, allowing another origin to influence form field values passed to Form#onSubmit().

Session fixation in Apache Wicket affects the AuthenticatedWebSession class and its signIn(String, String) method. The session id is renewed only on the first sign-in transition and not when an already signed-in session authenticates again, even though the method returns true in both cases. Exploitation requires an attacker to plant a chosen session id in the victim's browser, e.g. through control of a host under the same registrable domain or a container configured to carry the session id in the URL.

Apache Wicket fails to enforce resource authorization (isResourceAuthorized() or the @AuthorizeResource annotation) in ResourceLink, Image, ImageButton and AjaxDownloadBehavior components when a resource is passed as an IResource instance. In that case the resource is served without the permission check, while the same control works when a ResourceReference is used. ExportToolbar is also affected because it builds its export links from IResource instances.

Apache Wicket has a missing authorization flaw that allows a component's listener to be invoked even when the authorization strategy denied the RENDER action for it. A crafted or even standard listener URL without a page identifier skips the render phase and Component#configure(), leaving the visibility flag at its constructor default. Components hidden or disabled in Component#onConfigure() are equally exposed.

The vulnerability in Apache Wicket is insufficient session expiration in native WebSocket support. A WebSocket connection keeps a copy of the HTTP session from when it was opened, so invalidating the session via the container (idle timeout, logout, filter invalidate) does not end the connection — subsequent frames still resolve the revoked identity and its attributes.

Apache Wicket fails to check authorization before invoking onMessage() callbacks in WebSocketBehavior. A client message is delivered to every WebSocketBehavior on the page, even when the component it is attached to is hidden, disabled, or denied by IAuthorizationStrategy — unlike Ajax behaviors, which perform this check.

Apache Wicket versions 10.3.0 through 10.11.0 contain a missing authorization vulnerability in form handling. The form resolves the submitting component from request parameters and passes it directly to onFormSubmitted(), skipping the visibility and enablement check. As a result, a request can invoke actions of a button or link that the application withheld.