105 matches found
CVE-2022-40635 Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass...
CVE-2022-40634
CVE-2022-40634 affects Crafter CMS Crafter Studio. The vulnerability arises from improper control of dynamically-managed code resources, enabling Server-Side Template Injection via FreeMarker (SSTI). Exploitation requires authenticated user credentials and can lead to OS command execution, as des...
CVE-2022-40634 Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI...
CVE-2022-40634
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI...
CVE-2022-40635
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass...
PT-2022-25431 · Crafter Cms · Crafter Studio
Name of the Vulnerable Software and Affected Versions: Crafter Studio of Crafter CMS affected versions not specified Description: The issue allows authenticated developers to execute OS commands via FreeMarker SSTI due to improper control of dynamically-managed code resources. Recommendations: At...
Crafter CMS 安全漏洞
Crafter CMS is an open source content management system CMS for digital experience applications. A security vulnerability exists in Crafter CMS Crafter Studio versions prior to 3.1.23, which stems from improperly controlled dynamic management code resources that allow authenticated developers to...
Cross site scripting in Crafter CMS
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel...
GHSA-P2VM-88RG-WFR2 XML injection in Crafter CMS
In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band...
GHSA-2RR8-9C6G-8J5C Missing Authorization in Crafter CMS
In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data...
GHSA-38RQ-RH9W-CMW6 Cross site scripting in Crafter CMS
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel...
GHSA-R6FX-55X3-F9X6 Crafter CMS Crafter Studio vulnerable to Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
Crafter CMS Crafter Studio vulnerable to Improper Control of Dynamically-Managed Code Resources
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
CVE-2021-23267
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
CVE-2021-23267
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
Design/Logic Flaw
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
CVE-2021-23267
CVE-2021-23267 affects Crafter CMS, specifically Crafter Studio. The issue is an improper control of dynamically-managed code resources that enables authenticated developers to execute operating-system commands via FreeMarker static methods. The primary impact described across sources is high sev...
CVE-2021-23267 Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods...
CVE-2021-23266 Improper Output Neutralization for Logs in Crafter Studio
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...