RHEL 8 : pcs (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ejs: server-side template injection in outputFunctionName CVE-2022-29078 - The package handlebars before...

Prototype Pollution

ejs is vulnerable to Prototype Pollution. The vulnerability is due to inadequate object checks which lack prototype protection measures, which allows an attackers to overwrite certain object prototypes...

ejs lacks certain pollution protection

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

GHSA-GHR5-CH3P-VCR6 ejs lacks certain pollution protection

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

5ug-cli (>=1.0.72, <=1.4.0), @0xgraph/cli (>=0.0.1, <=0.2.1) +826 more potentially affected by CVE-2024-33883 via ejs (>=3.0.1, <=3.1.9)

ejs NPM version =3.0.1, =1.0.72, =0.0.1, =1.1.0, =0.1.7, =0.0.9, =1.0.1, =2.16.49, =1.2.4, =1.15.41, =2.0.0-beta.2, =2.0.0-beta.2, =1.1.21, =1.4.3 and more Source cves: CVE-2024-33883 Source advisory: OSV:GHSA-GHR5-CH3P-VCR6...

5ug-cli (>=1.0.72, <=1.4.0), @0xgraph/cli (>=0.0.1, <=0.2.1) +826 more potentially affected by CVE-2024-33883 via ejs (>=3.0.1, <=3.1.9)

ejs NPM version =3.0.1, =1.0.72, =0.0.1, =1.1.0, =0.1.7, =0.0.9, =1.0.1, =2.16.49, =1.2.4, =1.15.41, =2.0.0-beta.2, =2.0.0-beta.2, =1.1.21, =1.4.3 and more Source cves: CVE-2024-33883 Source advisory: GHSA-GHR5-CH3P-VCR6...

CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

DEBIAN-CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

UBUNTU-CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

PT-2024-4417

Name of the Vulnerable Software and Affected Versions ejs versions prior to 3.1.10 Description The issue is related to the lack of certain pollution protection in the ejs package, which can be exploited to execute arbitrary code by injecting specially crafted JavaScript code. This can be done by ...

CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

02url-querystring-http (>=1.0.1, <=1.0.4), 0xgank-tea-advice-pull (1.0.0) +32865 more potentially affected by CVE-2024-33883 via ejs (>=0.0.1, <=3.1.9)

ejs NPM version =0.0.1, =1.0.1, =1.0.4 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 - 0xgank-tea-child-evening 1.0.0 - 0xgank-tea-construction-ea...

CVE-2024-33883

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

CVE-2024-33883

The ejs (Embedded JavaScript templates) package for Node.js prior to version 3.1.10 is vulnerable to prototype pollution due to a lack of sufficient validation. An attacker can exploit this by polluting the opts.client and opts.escapeFunction properties. If the attacker gains control of the rende...

CVE-2024-33883: Protection Mechanism Failure

The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection...

ejs security vulnerabilities

Github ejs are embedded JavaScript templates. A security vulnerability exists in ejs Embedded JavaScript templates versions prior to 3.1.10, which stems from the lack of some pollution protection...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-29827 DESCRIPTION: Node.js ejs module could allow a remote authenticated attacker t...

Prototype Pollution in ali-security/mongoose

Impact This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate. For applications using Express and EJS, this can potentially allow remote code execution. Patches The original patched version for mongoose 5.3.3 did not include a fix for...

GHSA-RC4V-99CR-PJCM Prototype Pollution in ali-security/mongoose

Impact This vulnerability causes a Prototype Pollution in document.js, through functions such as findByIdAndUpdate. For applications using Express and EJS, this can potentially allow remote code execution. Patches The original patched version for mongoose 5.3.3 did not include a fix for...