SRC-2022-0005 : VMware Workspace ONE Access customError.ftl Server-side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within the customError.ftl template. The issue results from...

GitHub Security Lab: Java : Add query to detect Server Side Template Injection (SSTI)

This bug was reported directly to GitHub Security Lab...

Server Side Template Injection in MCMS

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

GHSA-GC79-GH4F-9G6W Server Side Template Injection in MCMS

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

Sql injection

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

CVE-2021-46063: Improper Control of Generation of Code

MCMS v5.2.5 was discovered to contain a Server Side Template Injection SSTI vulnerability via the Template Management module...

CVE-2021-46362

Magnolia CMS is affected by a Server-Side Template Injection (SSTI) in the Registration and Forgotten Password forms via the fullname parameter for Magnolia versions prior to 6.2.3. The root cause is SSTI that can allow arbitrary code execution, with high-severity impact (CVSS 3.1: CRITICAL, base...

specberus (>=4.4.4, <=5.6.2) potentially affected by CVE-2021-32820 via express-handlebars (>=5.1.0, <=5.3.0)

express-handlebars NPM version =5.1.0, =4.4.4, =5.6.2 Source cves: CVE-2021-32820 Source advisory: OSV:GHSA-FR76-2WP8-FP92...

Server side template injection — SSTI vulnerability ⚠️

Server side template injection — SSTI vulnerability ⚠️ Introduction There is hardly any software development or other linked elements that haven’t fallen into the trap of cyber vulnerabilities. Templates, used for HTML code management on the server-side, are amongst them. The attack targeting the...

bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2021-23372 via mongo-express (>=0.19.0, <=0.53.0)

mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2021-23372 Source advisory: OSV:GHSA-M2R3-8492-VX59...

Sql injection

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

CVE-2021-39128

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

CVE-2021-39128: Improper Neutralization of Special Elements Used in a Template Engine

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira...

CVE-2021-39115: Improper Neutralization of Directives in Statically Saved Code

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a ServerSide Template Injection vulnerability in the Email Template feature. The affected...

CVE-2021-35450

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

Sql injection

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

CVE-2021-35450

CVE-2021-35450 concerns a Server Side Template Injection in the Entando Admin Console, affecting version 6.3.9 and earlier. The flaw allows a user with privileges to trigger FreeMarker template execution via freemarker.template.utility.Execute, potentially enabling command execution. According to...

CVE-2021-35450

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

CVE-2021-35450: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template with command execution via freemarker.template.utility.Execute...

PT-2021-20915

Name of the Vulnerable Software and Affected Versions: Entando Admin Console versions 6.3.9 and earlier Description: A Server Side Template Injection in the Entando Admin Console allows a user with privileges to execute FreeMarker template with command execution via...