1191 matches found
CVE-2023-26092
Liima before 1.17.28 allows server-side template injection...
PT-2023-20481
Name of the Vulnerable Software and Affected Versions Liima versions prior to 1.17.28 Description The issue allows server-side template injection. Recommendations For versions prior to 1.17.28, update to version 1.17.28 or later to resolve the issue...
CVE-2023-26092
Liima up to version 1.17.27 is vulnerable to server-side template injection. The issue arises in Liima’s templating flow and can lead to arbitrary code execution or access to sensitive data as indicated by the CVE details (high impact). Remediation: upgrade to Liima 1.17.28 or later (the fixed ve...
CVE-2023-26092
Liima before 1.17.28 allows server-side template injection...
CVE-2023-26092: Improper Neutralization of Special Elements used in an Expression Language Statement
Liima before 1.17.28 allows server-side template injection...
CVE-2023-26092
Liima before 1.17.28 allows server-side template injection...
SSTImap - Automatic SSTI Detection Tool With Interactive Interface
SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection...
Froxlor 2.0.6 Remote Command Execution via Arbitrary File Write and Server Side Template Injection
Description Froxlor 2.0.6 Stable is suffering from Remote Command Execution that was achieved by chaining two bugs, the first one is an arbitrary file write on the logging feature, which allows an authenticated attacker to point the log file to any writable path even if it was the web server...
PT-2022-28088 · Jetbrains · Intellij Idea
Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3.1 Description: The issue concerns SSTI attacks on code Templates in JetBrains IntelliJ IDEA. SSTI stands for Server-Side Template Injection, which is a type of vulnerability that allows attacke...
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Impact The user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template Injection RCE. Patches Update to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patch Workarounds Apply...
CVE-2022-39365
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...
Design/Logic Flaw
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...
CVE-2022-39365 RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...
CVE-2022-39365
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in "Pimcore/Mail" & "ClassDefinition\Layout\Text" is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9...
PT-2022-24932
Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.5.9 Description The user-controlled twig templates rendering in Pimcore/Mail and ClassDefinitionLayoutText is vulnerable to server-side template injection, which could lead to remote code execution. Recommendations...
CVE-2022-39365: Improper Control of Generation of Code
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...
[Security Nation] James Kettle of PortSwigger on Advancing Web-Attack Research
!\Security Nation\ James Kettle of PortSwigger on Advancing Web-Attack Researchhttps://blog.rapid7.com/content/images/2022/10/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod talk to James Kettle of PortSwigger. Their discussion includes research for new web-attack technique...
FortiSOAR - Server-Side Template Injection in Playbook component
An improper neutralization of special elements used in a template engine vulnerability CWE-1336 in FortiSOAR management interface may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload...