395 matches found
Discourse < 2.3.0.beta9 Multiple Vulnerabilities
Discourse is prone to multiple vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
@11ty/eleventy (=0.3.3), @36node/swagen (=0.1.2) +671 more potentially affected by unknown CVE via handlebars (>=4.0.0 <=4.0.13)
handlebars NPM version =4.0.0, =1.0.1, =3.0.0, =1.0.0, =0.1.0, =0.0.1, =1.0.0, =5.0.0, =5.0.0, =2.0.1, =0.4.2, =2018.4.29-7, =2018.4.29-8, =2018.5.11-6, =2018.6.16-0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...
@abeai/node-sdk (>=6.2.1 <=7.3.1), @after-work.js/aw (>=6.0.0 <=6.0.5) +62 more potentially affected by unknown CVE via handlebars (>=4.1.0 <=4.1.1)
handlebars NPM version =4.1.0, =6.2.1, =6.0.0, =6.0.0, =0.0.41, =0.9.9, =0.4.0, =1.0.4, =0.2.6, =1.2.0-6a4545aa-b24, =1.0.0-beta.2, =3.9.4, =1.5.3, =7.0.0, =7.0.21 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...
101 (>=0.3.0 <=0.7.1), 3c (>=0.0.1 <=1.0.0-alpha) +3346 more potentially affected by unknown CVE via handlebars (>=1.0.10 <=3.0.3)
handlebars NPM version =1.0.10, =0.3.0, =0.0.1, =0.0.1, =1.0.0, =1.0.1, =1.0.0, =1.31.0, =0.1.16, =0.9.33, =0.9.33, =5.0.2, =5.0.3, =5.0.6, =5.0.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q42P-PG8M-CQH6...
GHSA-Q42P-PG8M-CQH6 Prototype Pollution in handlebars
Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...
Prototype Pollution in handlebars
Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...
Fedora 30 : nodejs-handlebars (2019-c1213f866c)
Security fix for https://www.npmjs.com/advisories/755 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...
Remote Code Execution
handlebars is vulnerable to remote code execution. The vulnerability exists because it is possible to manipulate the template and access the constructor in the template, allowing an attacker to inject arbitrary code through it...
Remote Code Execution (RCE)
handlebars is vulnerable to remote code execution. Access to the constructor in templates is not prohibited, allowing an attacker to inject arbitrary templates into the Handlebars setup and execute arbitrary code...
Prototype Pollution
Overview Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.1...
08cms (=1.0.0), 101 (>=0.3.0 <=0.7.1) +4159 more potentially affected by CVE-2015-8861 via handlebars (>=1.0.10 <=3.0.8)
handlebars NPM version =1.0.10, =0.3.0, =0.0.1, =0.0.2, =0.0.16, =0.0.1, =1.2.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =2.0.4, =1.0.13, =1.0.0, =1.0.1 and more Source cves: CVE-2015-8861 Source advisory: OSV:GHSA-9PRH-257W-9277...
GHSA-9PRH-257W-9277 Cross-Site Scripting in handlebars
Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...
Cross-Site Scripting in handlebars
Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...
Cross site scripting
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...
CVE-2014-0013
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...
CVE-2014-0013
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...
Moderate severity vulnerability that affects handlebars
Withdrawn: Duplicate of GHSA-9prh-257w-9277...
Cross-site Scripting (XSS)
rendr-handlebars is vulnerable to cross-site scripting XSS attacks. This is because unsanitized data is passed to the client, allowing the attacks to be performed...