[SECURITY] Fedora 33 Update: php-zordius-lightncandy-1.2.5-1.fc33

An extremely fast PHP implementation of handlebars http://handlebarsjs.co m/ and mustache http://mustache.github.io/...

CVE-2020-14193

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & /jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are thos...

CVE-2020-14193

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & /jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are thos...

Sql injection

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & /jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are thos...

CVE-2020-14193

CVE-2020-14193 affects Automation for Jira - Server: a template injection in Jira smart values using mustache partials allowed remote attackers to read and render files in WEB-INF/classes and /jira/bin via mustache templates. Affected versions are before 7.1.15. Atlassian/JIRAAUTOSERVER-185 notes...

Atlassian JIRA Server Injection Vulnerability

Atlassian JIRA Server is the server version of a defect tracking management system from Atlassian Australia. The system is mainly used for tracking and managing various types of issues and defects in the workplace. An injection vulnerability exists in versions prior to Jira 7.1.15, which allows...

Template injection vulnerability in Automation for Jira smart values - CVE-2020-14193

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & /jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are thos...

Template injection vulnerability in Automation for Jira smart values - CVE-2020-14193

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & /jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The affected versions are thos...

PT-2022-5145 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to the recursive rendering of Mustache template helpers containing user input, which could result in a Cross-site Scripting risk or a page failing to load. This is due t...

PT-2023-21656 · Unknown +1 · Moodle Lms +1

Name of the Vulnerable Software and Affected Versions: Moodle LMS affected versions not specified Description: The Mustache pix helper contained a potential Mustache injection risk if combined with user input. It is noted that this issue did not appear to be implemented or exploitable anywhere in...

[SECURITY] Fedora 30 Update: nodejs-handlebars-4.0.13-1.fc30

Handlebars.js is an extension to the Mustache templating language created by Chris Wanstrath. Handlebars.js and Mustache are both logicless templating languages that keep the view and the code separated like we all know they s hould be...

Moderate severity vulnerability that affects mustache

Withdrawn, accidental duplicate publish. mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

GHSA-3233-RGX3-C2WH Moderate severity vulnerability that affects mustache

Withdrawn, accidental duplicate publish. mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

Cross-site Scripting (XSS)

mustache is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper sanitization of the variables used in templates, allowing arbitrary HTML code, including JavaScript JS code, to be executed when rendered...

Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tuleap 9.6 Second-Order PHP Object Injection', 'Description' = %q This module exploits a Second-Order PHP Object Injection vulnerability in Tulea...

Tuleap 9.6 Second-Order PHP Object Injection Exploit

This Metasploit module exploits a Second-Order PHP Object Injection vulnerability in Tuleap 'Tuleap 9.6 Second-Order PHP Object Injection', 'Description' = %q This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap = 9.6 which could be abused by authenticated users to...

@bcpros/bitcore-wallet-service (8.25.45), @cron-eu/gulp-iconify (>=0.5.1, <=0.6.1) +72 more potentially affected by CVE-2015-8862 via mustache (>=2.0.0, <=2.2.0)

mustache NPM version =2.0.0, =0.5.1, =0.0.0, =0.0.0, =2.0.0-alpha.8, =0.2.0, =0.1.0, =0.3.0, =0.1.0, =1.0.0, =0.0.1, =3.0.0, =3.1.1 and more Source cves: CVE-2015-8862 Source advisory: OSV:GHSA-W3W8-37JV-2C58...

Cross-Site Scripting in mustache

Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted. Example Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 2.2.1 or later. Alternatively, ensure that all...

GHSA-W3W8-37JV-2C58 Cross-Site Scripting in mustache

Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted. Example Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 2.2.1 or later. Alternatively, ensure that all...

Tuleap 9.6 Second-Order PHP Object Injection

This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap use exploit/unix/webapp/tuleap/restunserializeexec msf undefinedrestunserializeexec show actions ...actions... msf undefinedrestunserializeexec set ACTION msf undefinedrestunserializeexec show options ...show and set...