CVE-2021-25283: Improper Control of Generation of Code

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

CVE-2021-25283

A flaw was found in Salt. The jinja renderer does not protect against server-side template injection attacks. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

SaltStack Salt Code Injection Vulnerability

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A code injection vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from a failure of t...

salt -- multiple vulnerabilities

SaltStack reports multiple security vulnerabilities in Salt CVE-2021-3197: The Salt-API.s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument, or via sshoptions provided in an API request. CVE-2021-25281: The Salt-API does not have eAuth credentials for the...

PT-2021-16960

Name of the Vulnerable Software and Affected Versions CS-Cart affected versions not specified Description The issue concerns a Server Side Template Injection Remote Code Execution vulnerability. Recommendations At the moment, there is no information about a newer version that contains a fix for...

Exploit for CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote...

CVE-2021-25770

In JetBrains YouTrack before 2020.5.3123, server-side template injection SSTI was possible, which could lead to code execution...

Theonedev Onedev Injection Vulnerability (CNVD-2021-09800)

Theonedev Onedev is a JAVA-based all-in-one DevOps platform from the Theonedev team. The platform supports container build, orchestration, CI, Git management, team collaboration and other features to help developers build a simple, powerful development platform. Theonedev An injection vulnerabili...

CVE-2021-25770: Improper Control of Generation of Code

In JetBrains YouTrack before 2020.5.3123, server-side template injection SSTI was possible, which could lead to code execution...

JetBrains YouTrack 代码注入漏洞

YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. A server-side template injection vulnerability exists in JetBrains YouTrack versions prior to 2020.5.3123. An...

CVE-2021-21244

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation...

CVE-2021-21244

CVE-2021-21244 affects OneDev before version 4.0.3. A pre-auth server-side template injection occurs via tampering with Bean validation messages, enabling SSTI. The root cause is failure in validation message handling that allows interpolation to be exploited. The issue was fixed in 4.0.3 by disa...

CVE-2021-21244: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation...

Server-Side Template Injection (SSTI)

pwntools is vulnerable to server-side template injection. An attacker is able to inject and execute arbitrary code via the Shellcraft generation due to insecure parsing of strings that containing end of multiline comment...

CVE-2020-28468

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...

CVE-2020-28468

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...

Remote code execution

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection SSTI, which can lead to remote code execution...

@11ty/eleventy (0.3.3), @36node/swagen (0.1.2) +2021 more potentially affected by CVE-2021-23383 via handlebars (>=4.0.0, <=4.7.6)

handlebars NPM version =4.0.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.0.1, =0.4.0, =3.0.0-dev.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =1.0.2-alpha.0, =1.0.0, =1.2.1 and more Source cves: CVE-2021-23383 Source advisory: SNYK:JS-HANDLEBARS-1279029...

Server-Side Template Injection

browserup-proxy is vulnerable to server-side template injection. The vulnerability exists through the lack of sanitization of value when displaying error messages...