CVE-2024-4879

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticate...

CVE-2024-4879

Jelly Template Injection Vulnerability in ServiceNow | POC CVE-2024-4879 Description: ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington, D.C. Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: jackson-databind (UTSA-2026-091341)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091341 advisory. FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +5 more potentially affected by CVE-2026-84655 via org.kohsuke.stapler:stapler (>=2092.v91b_2c63e0c97, <=2107.v8dfcb_e8ed317)

org.kohsuke.stapler:stapler MAVEN version =2092.v91b2c63e0c97, =444.v568b174ece88, =2.569, =2.569, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2107.v8dfcbe8ed317 Source cves: CVE-2026-84655 Source advisory: MEND:CVE-2026-84655...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +5 more potentially affected by CVE-2026-84654 via org.kohsuke.stapler:stapler (>=2092.v91b_2c63e0c97, <=2107.v8dfcb_e8ed317)

org.kohsuke.stapler:stapler MAVEN version =2092.v91b2c63e0c97, =444.v568b174ece88, =2.569, =2.569, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2107.v8dfcbe8ed317 Source cves: CVE-2026-84654 Source advisory: MEND:CVE-2026-84654...

io.jenkins.plugins:design-library (>=444.v568b_174ece88, <=483.v401c307fdd1b), io.jenkins.plugins:login-theme (339.v8f0b_a_5695303) +5 more potentially affected by CVE-2026-84647 via org.kohsuke.stapler:stapler (>=2092.v91b_2c63e0c97, <=2107.v8dfcb_e8ed317)

org.kohsuke.stapler:stapler MAVEN version =2092.v91b2c63e0c97, =444.v568b174ece88, =2.569, =2.569, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2092.v91b2c63e0c97, =2107.v8dfcbe8ed317 Source cves: CVE-2026-84647 Source advisory: MEND:CVE-2026-84647...

Server-Side Request Forgery (SSRF)

github.com/jon4hz/jellysweep is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the URL parameter in the /api/images/cache endpoint, which allows an authenticated attacker to make the server download arbitrary content from attacker-controlled URL...

EUVD-2014-5636

Malware in sbrugna...

EUVD-2020-0384

Malware in sbrugna...

EUVD-2022-2787

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-12621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a SYSTEM entity with a URL and that entity is used in the body of...

Exploit for Improper Validation of Specified Type of Input in Servicenow

Jelly Template Injection Vulnerability in ServiceNow | POC CVE...

VulnCheck KEV: CVE-2024-4879

ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely...

Exploit for Improper Validation of Specified Type of Input in Servicenow

CVE-2024-4879 Exploit & PoC - Nuclei Template CVE-2024-4879 -...

CVE-2024-4879 Jelly Template Injection Vulnerability in ServiceNow UI Macros

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted...

Script Security sandbox bypass vulnerability in email-ext

email-ext allows defining custom email templates using https://plugins.jenkins.io/config-file-provider/Config File Provider plugin as Jelly or Groovy files. When defined inside a https://plugins.jenkins.io/cloudbees-folder/folder, email templates need to be subject to Script Security protection...

Storing Passwords in a Recoverable Format

Overview org.jenkins-ci.plugins:credentials-binding is a plugin that allows credentials to be bound to environment variables for use from miscellaneous build steps. Affected versions of this package are vulnerable to Storing Passwords in a Recoverable Format via the config-variables.jelly file,...

Improper Restriction of XML External Entity Reference in Jelly

During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity XXE...

com.canoo:webtest (>=586, <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0-beta-4, <=1.0)

commons-jelly:commons-jelly MAVEN version =1.0-beta-4, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-m5, =1.0.1, =1.3, =1.9 - jepi:jepi 1.0 - marmalade:marmalade-compat-jelly 1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin 1.3 and more Source cves: CVE-2017-12621 Source advisory:...

com.canoo:webtest (>=586, <=1393), com.flexiblewebsolutions.xdriveunit:xdriveunit (0.3) +79 more potentially affected by CVE-2017-12621 via commons-jelly:commons-jelly (>=1.0-beta-4, <=1.0)

commons-jelly:commons-jelly MAVEN version =1.0-beta-4, =586, =0.1, =1.0, =20050708.205531, =1.2, =1.0-m5, =1.0.1, =1.3, =1.9 - jepi:jepi 1.0 - marmalade:marmalade-compat-jelly 1.0-alpha-3 - maven-plugins:maven-sourceforge-plugin 1.3 and more Source cves: CVE-2017-12621 Source advisory:...