32 matches found
CVE-2020-18324
Subrion CMS 4.2.1 – Kickstart 模板中的反射型 XSS 漏洞 描述 Subrion CMS 易于安装且管理简单。可将其作为独立应用程序使用，或与其他应用程序结合，用于构建入门级、中型或大型网站。 在 Subrion CMS v.4.2.1 的 "Kickstart" 网页应用模板中，通过 "search" 组件发现了反射型跨站脚本（XSS）漏洞，该漏洞允许远程攻击者注入任意 JavaScript 代码。 日期 ：2022-02-22 软件链接 ：https://subrion.org 漏洞发现者 ：HaMM0nz CVE 编号 ：CVE-2020-18324 ...
PYSEC-2026-794 Cobbler is vulnerable to code injection
templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...
PYSEC-2026-795 Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...
CVE-2026-44916
In OpenStack Ironic before 35.0.2 in a certain non-default configuration, instanceinfo'kstemplate' is rendered without sandboxing...
CVE-2026-44916
CVE-2026-44916 affects OpenStack Ironic up to version 35.x, where rendering of instance_info['ks_template'] occurs without sandboxing. The root cause is the lack of sandboxing during template rendering, which can expose sensitive information or enable unintended behavior within the template execu...
CVE-2026-44916
In OpenStack Ironic before 35.0.2 in a certain non-default configuration, instanceinfo'kstemplate' is rendered without sandboxing...
CVE-2026-44916
In OpenStack Ironic before 35.0.2 in a certain non-default configuration, instanceinfo'kstemplate' is rendered without sandboxing...
PT-2026-38679
Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 36.0 Description In OpenStack Ironic, the ks template variable within instance info is rendered without sandboxing. Sandboxing is a security mechanism that isolates executing code to prevent it from accessing...
EUVD-2022-1583
Malicious code in bioql PyPI...
[SECURITY] Fedora 40 Update: cobbler-3.3.7-1.fc40
Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors,...
SUSE CVE-2008-6954
The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...
SUSE CVE-2010-2235
templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...
Cobbler is vulnerable to code injection
templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...
GHSA-P8W2-F44P-FMCJ Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...
Improper Control of Generation of Code ('Code Injection')
CVE-2010-2235 RHN Satellite cobbler: Code injection flaw ACE as root by processing of a specially-crafted kickstart template file...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The web interface CobblerWeb in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules...
Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2022-20164)
Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into websites and supports multiple extension plugins, etc. A security vulnerability exists in Subrion CMS 4.2.1, which can be exploited by attackers via the q parameter in the Kickstart...
Cross-site Scripting in Subrion CMS
Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template...