GCVE - cpe:2.3:a:apache:wicket:6.1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:wicket:6.1.1:*:*:*:*:*:*:*

part: a version: 6.1.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Wicket (`47617a88-095f-5d07-871a-faa63ba3b71d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/wicket`	purl2cpe	2026-06-01 10:14:30.304059
`pkg:github/apache/wicket`	purl2cpe	2026-06-01 10:14:30.304060
`pkg:maven/org.apache.wicket/wicket-core`	purl2cpe	2026-06-01 10:14:30.304061
`pkg:sourceforge/wicket`	purl2cpe	2026-06-01 10:14:30.304063

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3526`	vulnerable	2026-06-08 05:05:33.251773	Details available Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions. Published: 2017-10-30T14:00:00.000Z Updated: 2024-08-06T10:50:16.801Z Open on db.gcve.eu Reference links https://wicket.apache.org/news/2014/09/22/cve-2014-3526.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2055`	vulnerable	2026-06-08 05:03:58.155651	Details available Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x before 6.8.0 allows remote attackers to obtain sensitive information via vectors that cause raw HTML templates to be rendered without being processed and reading the information that is outside of wicket:panel markup. Published: 2014-02-10T23:00:00.000Z Updated: 2024-08-06T15:20:37.447Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2014/Feb/38 https://wicket.apache.org/2014/02/06/cve-2013-2055.html http://osvdb.org/102955 https://wicket.apache.org/2013/05/17/wicket-6.8.0-released.html http://www.securityfocus.com/bid/65431	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5636`	vulnerable	2026-06-08 05:02:57.653595	Details available Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response. Published: 2017-10-30T19:00:00.000Z Updated: 2024-08-06T21:14:16.232Z Open on db.gcve.eu Reference links https://wicket.apache.org/news/2013/03/03/cve-2012-5636.html http://www.securityfocus.com/bid/101644	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.