Emond Papegaaij

Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Apache Wicket: XSS in Palette via getAdditionalAttributes

Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

Apache Wicket: XSS in Button via its model object