136 matches found
VulnCheck KEV: CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to ejs lack of pollution protection vulnerability [ CVE-2024-33883]
Summary Potential ejs aka Embedded JavaScript templates package lack of pollution protection vulnerability CVE-2024-33883 have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information...
The vulnerability of the ejs template for web application development in Node.js, related to incorrect elimination of special elements in the output data used by the incoming component, allows a hacker to execute arbitrary code.
The vulnerability of the ejs template for web application development in Node.js is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting specially craft...
Security Bulletin: Denial of service and password enumeration might affect IBM Storage Defender – Resiliency Service
Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2023-45288, CVE-2024-25031, CVE-2024-38322, CVE-2024-33883. Vulnerability Details CVEID:CVE-2023-45288 DESCRIPTION:...
Exploit for CVE-2024-33883
CVE-2024-33883 [email protected], Insufficient Prototype Pollutio...
VulnNodeApp - A Vulnerable Node.Js Application
A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js version with npm. Open...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service due to [CVE-2024-33883]
Summary Node.js module ejs is used by IBM App Connect Enterprise Certified Container for generating user interfaces in the DesignerAuthoring operand. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service. This bulletin provides patch...
RHEL 8 : pcs (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ejs: server-side template injection in outputFunctionName CVE-2022-29078 - The package handlebars before...
Prototype Pollution
ejs is vulnerable to Prototype Pollution. The vulnerability is due to inadequate object checks which lack prototype protection measures, which allows an attackers to overwrite certain object prototypes...
5ug-cli (>=1.0.72, <=1.4.0), @0xgraph/cli (>=0.0.1, <=0.2.1) +819 more potentially affected by CVE-2024-33883 via ejs (>=3.0.1, <=3.1.9)
ejs NPM version =3.0.1, =1.0.72, =0.0.1, =1.1.0, =0.1.7, =0.0.9, =1.0.1, =2.16.49, =1.2.4, =1.15.41, =2.0.0-beta.2, =2.0.0-beta.2, =1.1.21, =1.4.3 and more Source cves: CVE-2024-33883 Source advisory: OSV:GHSA-GHR5-CH3P-VCR6...
ejs lacks certain pollution protection
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
GHSA-GHR5-CH3P-VCR6 ejs lacks certain pollution protection
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
CVE-2024-33883
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
DEBIAN-CVE-2024-33883
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
UBUNTU-CVE-2024-33883
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
CVE-2024-33883
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
CVE-2024-33883
The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...
ejs 安全漏洞
Github ejs are embedded JavaScript templates. A security vulnerability exists in ejs Embedded JavaScript templates versions prior to 3.1.10, which stems from the lack of some pollution protection...
PT-2024-4417 · Ejs +3 · Ejs +3
Name of the Vulnerable Software and Affected Versions: ejs versions prior to 3.1.10 Description: The issue is related to the lack of certain pollution protection in the ejs package, which can be exploited to execute arbitrary code by injecting specially crafted JavaScript code. This can be done b...
CVE-2024-33883
CVE-2024-33883 : The Node.js module ejs (Embedded JavaScript templates) , up to version before 3.1.10, lacks certain pollution protection, enabling local attackers to potentially cause a denial of service. The connected IBM/Astra Linux references confirm the same description. Reported impact: den...