743 matches found
CVE-2021-32820
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
Information disclosure
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32820
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32817
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
CVE-2021-32820
Summary (concrete details from sources): The CVE-2021-32820 issue affects Express-handlebars, a Handlebars view engine for Express. The vulnerability arises because the render API’s layout parameter can cause local file disclosure in downstream apps by including files with existing extensions; fi...
CVE-2021-32820 File disclosure in Express Handlebars
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
CVE-2021-32820
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @absa-subatomic/openshift-api (>=0.0.1, <=0.0.2) +769 more potentially affected by CVE-2021-32820 via express-handlebars (>=1.0.1, <=5.3.0)
express-handlebars NPM version =1.0.1, =0.0.16, =0.0.1, =2.0.1, =2.6.4, =1.0.0-aspect-sdm.20190822171313, =0.3.85-env-aspects.20190925133210, =1.0.5-master.20190403074739, =1.0.0-M.5a, =1.0.0-drift-sdm.20190822144852, =0.1.0-master.20191109234452, =0.1.0-master.20190918213400,...
CVE-2021-32817 File disclosure in express-hbs
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
CVE-2021-32820: Exposure of Sensitive Information to an Unauthorized Actor
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...
PT-2021-19954 · Unknown · Express-Handlebars
Name of the Vulnerable Software and Affected Versions: Express-handlebars affected versions not specified Description: The layout parameter in Express-handlebars may trigger file disclosure vulnerabilities in downstream applications, allowing inclusion of files with existing extensions. Files...
CVE-2021-32817: Exposure of Sensitive Information to an Unauthorized Actor
express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...
Express-HBS code injection vulnerability
handlebars is a semantic Web template system. An information disclosure vulnerability exists in express-hbs that stems from mixing pure template data with engine configuration options via the Express rendering API. Layout parameters may trigger a file disclosure vulnerability in downstream...
handlebars code injection vulnerability
handlebars is a semanticized web template system. A code injection vulnerability exists in Express-handlebars, where a layout parameter may trigger a file disclosure vulnerability in a downstream application...
Remote code execution when compiling templates
Overview handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source. Recommendation Upgrade to version 4.7.7 or later References - CVE - GitHub Advisory...
GHSA-F2JV-R9RF-7988 Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
org.webjars.npm:okta__okta-signin-widget (2.21.0) potentially affected by CVE-2021-23369 via org.webjars.npm:handlebars (4.0.14)
org.webjars.npm:handlebars MAVEN version 4.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:handlebars and may be impacted: - org.webjars.npm:oktaokta-signin-widget 2.21.0 Source cves: CVE-2021-23369 Source advisory:...
org.webjars.npm:okta__okta-signin-widget (2.21.0) potentially affected by CVE-2021-23369 via org.webjars.npm:handlebars (4.0.14)
org.webjars.npm:handlebars MAVEN version 4.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:handlebars and may be impacted: - org.webjars.npm:oktaokta-signin-widget 2.21.0 Source cves: CVE-2021-23369 Source advisory:...
@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +2021 more potentially affected by CVE-2021-23369 via handlebars (>=4.0.0, <=4.7.6)
handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =0.4.0, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =1.0.2-alpha.0, =1.0.0, =1.2.1 and more Source cves: CVE-2021-23369 Source advisory: GHSA-F2JV-R9RF-7988...
org.hildan.livedoc:livedoc-ui-webjar (>=0.4.2, <=3.0.0) potentially affected by CVE-2021-23369 via org.webjars:handlebars (2.0.0)
org.webjars:handlebars MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:handlebars and may be impacted: - org.hildan.livedoc:livedoc-ui-webjar =0.4.2, =3.0.0 Source cves: CVE-2021-23369 Source advisory:...