1453 matches found
CVE-2019-18582
Dell EMC Data Protection Advisor (DPA) REST API versions 6.3/6.4/6.5, 18.2 before patch 83, and 19.1 before patch 71 are affected by a server-side template injection vulnerability. A remote authenticated attacker with admin privileges can inject scripts via the report generation feature, potentia...
PT-2020-9968
Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5 Dell EMC Data Protection Advisor versions 18.2 prior to patch 83 Dell EMC Data Protection Advisor versions 19.1 prior to patch 71 Description: The issue concerns a server-side template...
CVE-2019-18582: Improper Control of Generation of Code
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
Server-Side Template Injection (SSTI)
nystudio107/craft-seomatic is vulnerable to server-side template injection. Lack of validation and sanitization allows an attacker to inject and execute arbitrary template variables that can lead to code execution via malicious data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
Sql injection
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
PT-2020-20739
Name of the Vulnerable Software and Affected Versions SEOmatic versions prior to 3.3.0 SEOmatic versions prior to 3.2.46 Description The issue allows Server-Side Template Injection that can lead to Remote Code Execution RCE via malformed data sent to the metacontainers controller. This can also...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not explicitly stated, but the collection includes various environments with different vulnerabilities, such as SQL injection, cross-site scripting XSS, and server-side template...
PT-2020-12484
Name of the Vulnerable Software and Affected Versions dropwizard-validation versions prior to 1.3.21 and 2.0.3 Description A server-side template injection was identified in the self-validating feature of dropwizard-validation, enabling attackers to inject arbitrary Java EL expressions, leading t...
PT-2020-6653 · Unknown · Dropwizard-Validation
Name of the Vulnerable Software and Affected Versions: Dropwizard-Validation versions prior to 1.3.19 Dropwizard-Validation versions prior to 2.0.2 Description: The issue allows arbitrary code execution on the host system with the privileges of the Dropwizard service account by injecting arbitrar...
PT-2020-6508
Name of the Vulnerable Software and Affected Versions PlaySMS versions prior to 1.4.3 Description The issue is related to insufficient sanitization of special elements in a string, which can be exploited by a remote attacker to execute arbitrary code. This is a server-side template injection...
SRC-2021-0002 : CSCart templates.manage Server Side Template Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CSCart. Authentication is required to exploit this vulnerability with the Files privilege. The specific flaw exists within the templates.manage dispatch method. The issue resul...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability is a Flask SSTI Server-Side Template Injection vulnerability. The target product/service is Flask, a Python web framework. The vulnerability class/vector is SSTI, which allows an attacker to...