1182 matches found
CVE-2020-26282
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was...
CVE-2020-26282: Improper Neutralization of Special Elements in Output Used by a Downstream Component
BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server, but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was...
PT-2020-16402
Name of the Vulnerable Software and Affected Versions BrowserUp Proxy versions prior to 2.1.2 Description A Server-Side Template Injection was identified in BrowserUp Proxy, enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE. This issu...
h1-ctf: Stopping Grinch to ruin XMas!
Hello, Gonna just submit flags first then will send my write up later tomorrow. flag1: flag48104912-28b0-494a-9995-a203d1e261e7 https://hackyholidays.h1ctf.com/robots.txt recon revealing hidden endpoint flag2: flagb7ebcb75-9100-4f91-8454-cfb9574459f7 https://hackyholidays.h1ctf.com/s3cr3t-ar3a...
CVE-2020-25967
The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...
Sql injection
The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...
CVE-2020-25967
The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...
CVE-2020-25967
The CVE refers to fastadmin, version 1.0.0.20200506_beta, with a Server-Side Template Injection (SSTI) in the member center function. The connected records reiterate this SSTI description but do not provide root cause details, affected subcomponents beyond the member center, or any remediation/wo...
CVE-2020-25967: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...
PT-2020-16258
Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20200506 beta Description The member center function in fastadmin is vulnerable to a Server-Side Template Injection SSTI vulnerability. This issue allows for the injection of templates on the server-side, potentially...
Exploit for Improper Input Validation in Redhat Openshift
This is a pre-built vulnerable Docker environment collection called Vulhub. It is an open-source project that provides a collection of vulnerable Docker environments for testing and learning purposes. The project is maintained by phith0n and is available on GitHub. The repository contains a varie...
CMS Made Simple 2.1.6 Server-Side Template Injection
Exploit Title: CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection Google Dork: N/A Date: 11/10/2017 Exploit Author: Gurkirat Singh Vendor Homepage: http://www.cmsmadesimple.org/ Software Link: N/A Version: 2.1.6 Tested on: Linux CVE : CVE-2017-16783 POC :...
vulhub1
It is an offensive tool for web application vulnerability training. The target product/service or framework is not explicitly stated, but the repository contains various vulnerable environments based on Docker-Compose, including Flask, Git, InfluxDB, and more. The vulnerability class/vector is no...
CVE-2020-21523: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the Freemarker template file. This file can cause arbitrary code execution when it is rendered in the background. exp: $test"touch /tmp/freemarkerPwned...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability is a Server-Side Template Injection SSTI vulnerability in a Flask application. The repository contains a Docker Compose file that sets up a vulnerable environment for testing and demonstration...
Server side template injection in Apache Camel
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
GitHub Security Lab: Python : Add query to detect Server Side Template Injection
This bug was reported directly to GitHub Security Lab...
vulhub
This is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for testing and training purposes. The primary CVE ID is not specified, but it includes various vulnerable environments based on Docker-Compose. The target product/service or framework is not...
CVE-2020-11994
A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure. The highest threat from this vulnerability is to data confidentiality...
