Threats tagged 'ghsa-cvcm-96v9-xgwm'

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 are affected by an improper neutralization of input vulnerability in the AjaxNewWindowNotifyingBehavior component. This vulnerability allows client-supplied window names containing single quotes to be injected into JavaScript without escaping, leading to cross-site scripting (XSS) when the page instance is rendered. The issue only affects applications that explicitly add this behavior to a component. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.