Emond Papegaaij

Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Apache Wicket: XSS in Palette via getAdditionalAttributes

Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Apache Wicket: XSS in Button via its model object