specberus (>=4.4.4, <=5.6.2) potentially affected by CVE-2021-32820 via express-handlebars (>=5.1.0, <=5.3.0)

express-handlebars NPM version =5.1.0, =4.4.4, =5.6.2 Source cves: CVE-2021-32820 Source advisory: OSV:GHSA-FR76-2WP8-FP92...

Regular Expression Denial of Service in Handlebars

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1559 more potentially affected by CVE-2019-20922 via handlebars (>=4.0.0, <=4.4.3)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: CVE-2019-20922 Source advisory: OSV:GHSA-62GR-4QP9-H98F...

GHSA-62GR-4QP9-H98F Regular Expression Denial of Service in Handlebars

Handlebars before 4.4.5 allows Regular Expression Denial of Service ReDoS because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +1579 more potentially affected by CVE-2019-20920 via handlebars (>=4.0.0, <=4.5.2)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =1.0.2-alpha.0, =1.0.0, =0.0.2-next.4, =5.0.0-alpha.1, =6.0.10 and more Source cves: CVE-2019-20920 Source advisory: OSV:GHSA-3CQR-58RM-57F8...

Arbitrary Code Execution in Handlebars

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

GHSA-3CQR-58RM-57F8 Arbitrary Code Execution in Handlebars

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars...

@behance/istanbul (0.3.17-sourcemap), @bigcommerce/stencil-paper (>=2.0.15, <=2.0.25) +220 more potentially affected by CVE-2019-20920 via handlebars (>=3.0.0, <=3.0.7)

handlebars NPM version =3.0.0, =2.0.15, =0.4.0, =0.0.60-IE, =1.3.1, =1.0.4, =0.11.0, =0.0.1, =0.0.5, =0.0.6, =1.2.0, =0.1.0, =0.4.9 and more Source cves: CVE-2019-20920 Source advisory: OSV:GHSA-3CQR-58RM-57F8...

Low: Red Hat Security Advisory: Openshift Logging 5.1.4 bug fix and security update

An update is now available for OpenShift Logging 5.1.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: Red Hat Quay v3.6.0 security, bug fix and enhancement update

An update is now available for Red Hat Quay 3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

The vulnerability of the Handlebars template creation tool is related to errors in code generation. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Handlebars template creation tool is related to errors in code generation. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: - Apache FOP - Underscore - Handlebars - PHP - sqlite Note that successful exploitatio...

@adobe/probot-serverless-openwhisk (>=4.0.24, <=4.0.54), @csnext/cs-layer-server (>=0.0.101-beta.22, <=0.0.132-beta.207) +101 more potentially affected by CVE-2021-32822 via hbs (>=4.0.0, <=4.1.2)

hbs NPM version =4.0.0, =4.0.24, =0.0.101-beta.22, =0.7.0, =0.7.0, =0.7.0, =0.19.0, =2.0.1, =0.1.5, =0.0.1-alpha.0, =0.1.2, =0.1.2, =0.1.0, =0.2.1, =0.0.2, =0.0.3 and more Source cves: CVE-2021-32822 Source advisory: OSV:GHSA-7F5C-RPF4-86P8...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

Arbitrary file deletion

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822 File disclosure in hbs

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822: Insertion of Sensitive Information into Externally-Accessible File or Directory

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

[R2] Tenable.sc 5.19.0 Fixes Multiple Third-party Vulnerabilities

Tenable.sc leverages third-party software to help provide underlying functionality. Multiple third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution, and in line with best practice, Tenable has upgraded the bundl...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Handlebars.js ( CVE-2019-19919, CVE-2021-32820)

Summary The product includes an older version of Handlebars.js that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2019-19919 DESCRIPTION: Node.js handlebars could allow a remote attacker to execute arbitrary code on the system, caused by a prototype...