395 matches found
CVE-2021-32820
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32817
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
CVE-2021-32820
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32817
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
Information disclosure
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32820 File disclosure in Express Handlebars
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32820
Summary (concrete details from sources): The CVE-2021-32820 issue affects Express-handlebars, a Handlebars view engine for Express. The vulnerability arises because the render API’s layout parameter can cause local file disclosure in downstream apps by including files with existing extensions; fi...
CVE-2021-32817 File disclosure in express-hbs
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
express-hbs 代码注入漏洞
handlebars is a semantic Web template system. An information disclosure vulnerability exists in express-hbs that stems from mixing pure template data with engine configuration options via the Express rendering API. Layout parameters may trigger a file disclosure vulnerability in downstream...
handlebars 代码注入漏洞
handlebars is a semanticized web template system. A code injection vulnerability exists in Express-handlebars, where a layout parameter may trigger a file disclosure vulnerability in a downstream application...
PT-2021-19954 · Unknown · Express-Handlebars
Name of the Vulnerable Software and Affected Versions: Express-handlebars affected versions not specified Description: The layout parameter in Express-handlebars may trigger file disclosure vulnerabilities in downstream applications, allowing inclusion of files with existing extensions. Files...
Remote code execution when compiling templates
Overview handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source. Recommendation Upgrade to version 4.7.7 or later References - CVE - GitHub Advisory...
GHSA-F2JV-R9RF-7988 Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
cn.home1:oss-configserver (>=1.0.6.OSS <=1.0.7.OSS), com.findwise.hydra:hydra-admin-service (>=0.4.1 <=0.5.0) +56 more potentially affected by CVE-2021-23369 via org.webjars:handlebars (>=1.0.0-rc.3 <=4.0.5)
org.webjars:handlebars MAVEN version =1.0.0-rc.3, =1.0.6.OSS, =0.4.1, =3.0.0.RELEASE, =0.0.1.RELEASE, =2.2.2.RELEASE, =6.3.0, =6.0.0.RELEASE, =1.8.6, =0.0.9, =0.0.9, =0.0.9, =0.0.12, =0.0.9, =0.0.9, =0.0.16 - com.github.jknack:mwa-wro4j =0.4.2 and more Source cves: CVE-2021-23369 Source advisory:...
08cms (=1.0.0), 101 (>=0.3.0 <=0.7.1) +6018 more potentially affected by CVE-2021-23369 via handlebars (>=1.0.10 <=4.7.6)
handlebars NPM version =1.0.10, =0.3.0, =0.0.1, =0.0.2, =0.0.16, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =0.4.0, =3.0.0, =1.0.0, =2.0.2 and more Source cves: CVE-2021-23369 Source advisory: OSV:GHSA-F2JV-R9RF-7988...
Prototype Pollution
handlebars is vulnerable to Prototype Pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
CVE-2021-23383
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source...