GHSA-7F5C-RPF4-86P8 Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

GHSA-H5Q8-5697-9P9H Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

Cross-Site Request Forgery in express-cart

The express-cart package through 1.1.10 for Node.js allows CSRF...

GHSA-JQFH-8HW5-FQJR Improper Handling of Exceptional Conditions in detect-character-encoding

Impact In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. Patches The problem has been patched in detect-character-encoding v0.7.0. CVSS score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C Base Score: 7.5 High Temporal Score: 7....

Template Injection

hbs is vulnerable to template injection. The vulnerability exists due to a lack of sanitization of configuration options when input into the system via the Express render API. An attacker is able to view a file by overwriting an internal configuration option...

GHSA-27WQ-QX3Q-FXM9 Improper Handling of Unexpected Data Type in ced

Impact In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. Patches The problem has been patched in ced v1.0.0. You can upgrade from v0.1.0 without any breaking changes. Workarounds Before passing an argument to ced, verify it’s a Buffer using Buffer.isBufferob...

TryGhost express-hbs information disclosure vulnerability

TryGhost express-hbs is an Express handlebar template engine with multiple layouts, blocks and cache sections. tryGhost express-hbs suffers from an information disclosure vulnerability that stems from the product's Express render API mixing pure template data with engine configuration options,...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

Arbitrary file deletion

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822 File disclosure in hbs

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822: Insertion of Sensitive Information into Externally-Accessible File or Directory

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

PT-2021-19955

Name of the Vulnerable Software and Affected Versions hbs affected versions not specified Description The hbs package, an Express view engine wrapper for Handlebars, may be vulnerable to a file disclosure issue depending on its usage. This occurs because hbs combines pure template data with engin...

TryGhost express-hbs 代码注入漏洞

TryGhost express-hbs is an Express handlebar template engine with multiple layouts, blocks and cache sections. tryGhost express-hbs suffers from an information disclosure vulnerability that stems from the product's Express render API mixing pure template data with engine configuration options,...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...

CVE-2020-22403

Cross Site Request Forgery CSRF vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts...