CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822 File disclosure in hbs

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

CVE-2021-32822: Insertion of Sensitive Information into Externally-Accessible File or Directory

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...

[R2] Tenable.sc 5.19.0 Fixes Multiple Third-party Vulnerabilities

Tenable.sc leverages third-party software to help provide underlying functionality. Multiple third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution, and in line with best practice, Tenable has upgraded the bundl...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Handlebars.js ( CVE-2019-19919, CVE-2021-32820)

Summary The product includes an older version of Handlebars.js that may be identified and exploited with automated tools. Vulnerability Details CVEID: CVE-2019-19919 DESCRIPTION: Node.js handlebars could allow a remote attacker to execute arbitrary code on the system, caused by a prototype...

io.ratpack:ratpack-codahale-metrics (0.9.16), io.ratpack:ratpack-groovy (0.9.16) +16 more potentially affected by CVE-2021-29479 via io.ratpack:ratpack-core (0.9.16)

io.ratpack:ratpack-core MAVEN version 0.9.16 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.16 - io.ratpack:ratpack-groovy 0.9.16 - io.ratpack:ratpack-groovy-test...

io.ratpack:ratpack-codahale-metrics (0.9.11), io.ratpack:ratpack-groovy (0.9.11) +16 more potentially affected by CVE-2021-29479 via io.ratpack:ratpack-core (0.9.11)

io.ratpack:ratpack-core MAVEN version 0.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.11 - io.ratpack:ratpack-groovy 0.9.11 - io.ratpack:ratpack-groovy-test...

io.ratpack:ratpack-codahale-metrics (0.9.7), io.ratpack:ratpack-groovy (0.9.7) +15 more potentially affected by CVE-2021-29479 via io.ratpack:ratpack-core (0.9.7)

io.ratpack:ratpack-core MAVEN version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.7 - io.ratpack:ratpack-groovy 0.9.7 - io.ratpack:ratpack-groovy-test 0.9....

io.ratpack:ratpack-codahale-metrics (0.9.0), io.ratpack:ratpack-groovy (0.9.0) +10 more potentially affected by CVE-2021-29479 via io.ratpack:ratpack-core (0.9.0)

io.ratpack:ratpack-core MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.0 - io.ratpack:ratpack-groovy 0.9.0 - io.ratpack:ratpack-groovy-test 0.9....

io.ratpack:ratpack-codahale-metrics (0.9.10), io.ratpack:ratpack-groovy (0.9.10) +16 more potentially affected by CVE-2021-29485 via io.ratpack:ratpack-core (0.9.10)

io.ratpack:ratpack-core MAVEN version 0.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.10 - io.ratpack:ratpack-groovy 0.9.10 - io.ratpack:ratpack-groovy-test...

io.ratpack:ratpack-codahale-metrics (0.9.0), io.ratpack:ratpack-groovy (0.9.0) +10 more potentially affected by CVE-2021-29485 via io.ratpack:ratpack-core (0.9.0)

io.ratpack:ratpack-core MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.0 - io.ratpack:ratpack-groovy 0.9.0 - io.ratpack:ratpack-groovy-test 0.9....

Handlebars information disclosure vulnerability (CNVD-2021-47375)

handlebars is a semantic Web template system. An information disclosure vulnerability exists in express-hbs that stems from mixing pure template data with engine configuration options via the Express rendering API. Layout parameters may trigger a file disclosure vulnerability in downstream...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise security and bug fix update

Red Hat OpenShift Container Platform release 4.6.36 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

OESA-2021-1196 nodejs-handlebars security update

Handlebars.js is an extension to the Mustache templating language created by Chris Wanstrath. Handlebars.js and Mustache are both logicless templating languages that keep the view and the code separated like we all know they should be. Security Fixes: The package handlebars before 4.7.7 are...

Insecure template handling in express-hbs

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

GHSA-RWXP-HWWF-653V Insecure template handling in express-hbs

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

Information Disclosure

express-handlebars is vulnerable to information disclosure. The vulnerability exists due to a the mixing of untrusted data with the express-handlebars options passed to the template data...

CVE-2021-32820

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

CVE-2021-32817

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

CVE-2021-32817

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...