Researchers Warn of New Phishing-as-a-Service Being Used by Cyber Criminals

Cyber criminals are using a previously undocumented phishing-as-a-service PhaaS toolkit called Caffeine to effectively scale up their attacks and distribute nefarious payloads. "This platform has an intuitive interface and comes at a relatively low cost while providing a multitude of features and...

Vtiger CRM Cross-Site Scripting Vulnerability

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A cross-site scripting vulnerability exists in Vtiger CRM v7.4.0, whic...

CVE-2022-38335

Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the e-mail template modules...

Vtiger CRM 跨站脚本漏洞

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A cross-site scripting vulnerability exists in Vtiger CRM v7.4.0, whic...

Atlassian Jira < 8.13.19 / 8.14.x < 8.20.7 / 8.21.x < 8.22.1 RCE (JRASERVER-73582)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is affected by remote code execution vulnerability. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute...

WordPress Plugin Email Templates 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-36799

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2022-36799

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2022-36799

Atlassian Jira Server/Data Center is affected by CVE-2022-36799 via Template Injection in Email Templates, enabling Remote Code Execution when an attacker with system administrator permissions exploits velocity templates. Affected versions are:

CVE-2022-36799

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

Atlassian Jira和Atlassian JIRA Data Center 代码注入漏洞

Atlassian Jira and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian Jira is a defect tracking management system. The system is used to track and manage all types of issues and defects on the job.Atlassian JIRA Data Center is the data center version of Atlassian JIRA. ...

PT-2022-3936 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.13.19 Atlassian Jira Server and Data Center versions 8.14.0 through 8.20.7 Atlassian Jira Server and Data Center versions 8.21.0 through 8.22.1 Description: The issue is related to a...

CVE-2022-36799

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

Atlassian Jira 8.14.x < 8.20.3 Template Injection

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by a vulnerability allowing remote attackers with administrator permissions to execute arbitrary code via Templat...

Atlassian Jira < 8.13.15 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by multiple vulnerabilities: - A template injection leading to remote code execution in the Email Templates featu...

Atlassian Jira < 8.13.15 Template Injection

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by a vulnerability allowing remote attackers with administrator permissions to execute arbitrary code via Templat...

Atlassian Jira 8.14.x < 8.20.3 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by multiple vulnerabilities: - A template injection leading to remote code execution in the Email Templates featu...

Atlassian Jira < 8.13.15 / 8.14.x < 8.20.3 / 8.21.0 (JRASERVER-73072)

The version of Atlassian Jira installed on the remote host is prior to 8.13.15 / 8.14.x 8.20.3 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73072 advisory. - Template Injection in Email Templates leads to code execution on Jira Service Management Server -...

GHSA-65WV-528R-M892 Improper Input Validation in strapi

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both...

GHSA-WJ5W-QGHH-GVQP Mattermost Server does not neutralize HTML content in an Email template field

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...