PT-2022-35909

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.331 Description A refcount leak was discovered in the ssi probe function of the omap ssi module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-35771

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.262 Description A refcount leak was discovered in the ssi probe function of the omap ssi module. The issue was introduced in version v3.16 and is fixed in version v4.19.262. The actual impact and attack...

PT-2022-35664

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 3.16 through 5.4.219 Description A refcount leak was discovered in the ssi probe function of the omap ssi module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versio...

PT-2022-35329 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.75 Description: A refcount leak was discovered in the ssi probe function of the omap ssi module. The issue was introduced in version v3.16 and is fixed in version v5.15.75. The actual impact and attack...

PT-2025-52938

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A resource leak was identified in the ssip pn open function within the SSI protocol of the Linux kernel. Specifically, the function claims an HSI client's port using hsi claim port. If h...

PT-2022-37835

Уязвимость функции ssip pn open модуля drivers/hsi/clients/ssi protocol.c драйвера высокоскоростного синхронного последовательного интерфейса HSI ядра операционной системы Linux связана с неправильным освобождением памяти «утечка памяти». Эксплуатация уязвимости может позволить нарушителю,...

tomcat:SsiExpressionParseTreeFuzzer: Security exception in org.apache.catalina.ssi.ExpressionParseTree$OrNode.evaluate

Project: https://github.com/apache/tomcat.git Detailed Report: https://oss-fuzz.com/testcase?key=5115151606480896 Project: tomcat Fuzzing Engine: libFuzzer Fuzz Target: SsiExpressionParseTreeFuzzer Job Type: libfuzzerasantomcat Platform Id: linux Crash Type: Security exception Crash Address: Cras...

ssi-w.com Cross Site Scripting vulnerability OBB-2756398

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-VJJP-9R83-22RC Django Directory Traversal via ssi template tag

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWEDINCLUDEROOTS setting followed by a .. dot dot in a ssi template tag...

Symfony Vulnerable to PHP Eval Injection

Applications with ESI support and SSI support as of Symfony 2.6 enabled and using the Symfony built-in reverse proxy the Symfony\Component\HttpKernel\HttpCache class are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server. HttpCache uses eval...

Symfony Incorrect Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...

PT-2025-49621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak exists in the ssi probe function when returning or breaking early from a for each available child of node loop. Specifically, the of node put function is not...

NETGEAR Wi-Fi Router SSI Injection

The vulnerability of the built-in Wi-Fi router software from NETGEAR, namely RBK40, RBR40, and RBS40, is related to incorrect code generation. Exploiting this vulnerability could allow an attacker to execute a Server Side Include Injection SSI attack...

PT-2021-18402

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 11.1.7 through 11.2.0 Description The issue allows an authenticated user to execute code remotely due to incorrectly neutralizing user-controlled input that could be interpreted as a server-side include SSI...

CVE-2021-29679: Improper Control of Generation of Code

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include SSI directive. IBM X-Force ID: 199915...

Security Bulletin: IBM Cognos Analytics with Watson 11.2.1 has addressed multiple vulnerabilities

Summary Security vulnerabilities have been addressed in IBM Cognos Analytics with Watson 11.2.1 Vulnerability Details CVEID: CVE-2017-12620 DESCRIPTION: Apache OpenNLP could allow a remote attacker to obtain sensitive information, caused by an XXE attack when loading models or dictionaries that...

Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)

Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting XSS Date: 05/21/2019 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 CVE : CVE-2019-0221 Requirements: SSI support must be enabled within Apache Tomcat. SSI support is no...

Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS) Vulnerability

Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting XSS Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 CVE : CVE-2019-0221 Requirements: SSI support must be enabled within Apache Tomcat. SSI support is not enabled by...

Apache Tomcat 9.0.0.M1 Cross Site Scripting

Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting XSS Date: 05/21/2019 Exploit Author: Central InfoSec Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 CVE : CVE-2019-0221 Requirements: SSI support must be enabled within Apache Tomcat. SSI support is no...

Microsoft SharePoint SSI / ViewState Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SharePoint Server-Side Include and ViewState RCE', 'Description' = %q This module exploits a server-side include SSI in SharePoint to...