[R1] Nessus Network Monitor Version 6.2.0 Fixes Multiple Vulnerabilities

R1 Nessus Network Monitor Version 6.2.0 Fixes Multiple Vulnerabilities Arnie Cabral Mon, 12/19/2022 - 10:28 Nessus Network Monitor leverages third-party software to help provide underlying functionality. Two of these third-party components moment.js, handlebars were found to contain...

Security Bulletin: Multiple vulnerabilities may affect IBM Business Automation Workflow - CVE-2018-25031, CVE-2021-23369, CVE-23383

Summary IBM Business Automation Workflow may be affected by vulnerabilities in swagger-ui. Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploi...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2022

Summary In addition to many updates of open source packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF011 and 22.0.1-IF001. Vulnerability Details CVEID:CVE-2022-33987 DESCRIPTION: Node.js got module could allow a remote attacker to...

@hidoo/express-engine-handlebars (=0.8.2), @hidoo/gulp-project-generator (=0.19.0) potentially affected by CVE-2021-35065 via glob-parent (=6.0.0)

glob-parent NPM version =6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on glob-parent and may be impacted: - @hidoo/express-engine-handlebars =0.8.2 - @hidoo/gulp-project-generator =0.19.0 Source cves: CVE-2021-35065 Source advisory:...

Malicious code in ember-handlebars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 044a9feb1ca13f566f1e0d6fc5fc0f4195a2e29a43979a45ea6260ab0db9ddf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2719 Malicious code in ember-handlebars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 044a9feb1ca13f566f1e0d6fc5fc0f4195a2e29a43979a45ea6260ab0db9ddf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Account Takeover via Webhook Handlebars + API Reset Password

Description Through the Webhook functionality, the attacker is able to use Handlebars to capture sensitive user data. Capturing the emailverificationtoken, which through the API I found the PasswordForget function, enabling account takeover via password reset. Steps 1. - Create Table 2. - Select...

GHSA-8XM3-GM7C-5FJX Ember.js Cross-site Scripting vulnerability

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

Security Bulletin: Node.js handlebars vulnerabilities affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center)

Summary Node.js handlebars module is vulnerable to a denial of service and allowing a remote attacker to execute arbitrary code on the system which affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details Third Party Entry: 171569 DESCRIPTION: Node.js...

GHSA-765H-QJXV-5F44 Prototype Pollution in handlebars

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source...

Prototype Pollution in handlebars

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source...

08cms (=1.0.0), 101 (>=0.3.0 <=0.7.1) +6018 more potentially affected by CVE-2021-23383 via handlebars (>=1.0.10 <=4.7.6)

handlebars NPM version =1.0.10, =0.3.0, =0.0.1, =0.0.2, =0.0.16, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =0.4.0, =3.0.0, =1.0.0, =2.0.2 and more Source cves: CVE-2021-23383 Source advisory: OSV:GHSA-765H-QJXV-5F44...

GHSA-FR76-2WP8-FP92 Insecure template handling in Express-handlebars

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

@42mo/42mo-web-styles (>=0.0.16 <=0.0.30), @absa-subatomic/openshift-api (>=0.0.1 <=0.0.2) +771 more potentially affected by CVE-2021-32820 via express-handlebars (>=1.0.1 <=5.3.0)

express-handlebars NPM version =1.0.1, =0.0.16, =0.0.1, =2.0.1, =2.6.4, =1.0.0, =0.3.85, =1.0.5-master.20190403074739, =1.0.0-M.5a, =1.0.0-drift-sdm.20190822144852, =0.1.0-master.20191109234452, =0.1.0, =0.1.1, =0.1.0-ipcrm-custom-event.20191122150318, =0.1.15, =0.1.29-master.20190822002550,...

Insecure template handling in Express-handlebars

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

@11ty/eleventy (=0.3.3), @36node/swagen (=0.1.2) +1560 more potentially affected by CVE-2019-20922 via handlebars (>=4.0.0 <=4.4.3)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2, =5.0.0, =6.0.10 and more Source cves: CVE-2019-20922 Source advisory: OSV:GHSA-62GR-4QP9-H98F...

Regular Expression Denial of Service in Handlebars

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

GHSA-62GR-4QP9-H98F Regular Expression Denial of Service in Handlebars

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

@11ty/eleventy (=0.3.3), @36node/swagen (=0.1.2) +1580 more potentially affected by CVE-2019-20920 via handlebars (>=4.0.0 <=4.5.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2, =5.0.0, =6.0.10 and more Source cves: CVE-2019-20920 Source advisory: OSV:GHSA-3CQR-58RM-57F8...

Arbitrary Code Execution in Handlebars

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...