GROWI OpenAI thread/message API endpoints do not perform authorization

GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

GROWI provided by GROWI, Inc

Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in…

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function

Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10

GROWI contains a missing authorization check vulnerability in its collaborative editing feature

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file…

GROWI contains an incorrect authorization vulnerability

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key