1453 matches found
Design/Logic Flaw
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
CVE-2019-19999
Halo prior to 1.2.0-beta.1 is vulnerable to Server Side Template Injection (SSTI) because FreeMarker configuration does not use TemplateClassResolver.SAFER_RESOLVER. The issue affects Halo’s template handling and can allow injection via SSTI in untrusted template processing. Affected: Halo versio...
PT-2019-16039
Name of the Vulnerable Software and Affected Versions Halo versions prior to 1.2.0-beta.1 Description The issue allows Server Side Template Injection SSTI due to the absence of TemplateClassResolver.SAFER RESOLVER in the FreeMarker configuration. Recommendations For versions prior to 1.2.0-beta.1...
Atlassian Jira 7.0.10 < 7.6.16 Template Injection Vulnerability
According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 7.6.16, 7.7.x 7.13.8, 8.1.x 8.1.3, 8.2.x 8.2.5, 8.3.x 8.3.4, 8.4.x 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importe...
CVE-2019-14965
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
Sql injection
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
CVE-2019-14965
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
PT-2019-13899
Name of the Vulnerable Software and Affected Versions Frappe Framework versions 10 through 12 before 12.0.4 Description A server-side template injection issue exists. This issue allows for the injection of templates on the server side, potentially leading to unauthorized access or data...
CVE-2019-14965: Improper Control of Generation of Code
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection SSTI issue exists...
CVE-2019-11581
CVE-2019-11581 affects Jira Server and Data Center (ContactAdministrators and SendBulkMail actions). The vulnerability is a server-side template injection that enables remote code execution when user-supplied input is rendered as a Velocity template. Affected versions include Jira Server/Data Cen...
CVE-2019-11581: Improper Neutralization of Special Elements in Output Used by a Downstream Component
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and...
Atlassian JIRA 7.6.x < 7.6.14, 7.13.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3 RCE
Binary data 700899.prm...
Code injection
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...
CVE-2019-10100
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...
CVE-2019-10100
CVE-2019-10100 affects JetBrains YouTrack Confluence Plugin prior to 1.8.1.3. The vulnerability is Server-Side Template Injection via an Issue macro on a Confluence page, where a crafted link-text-template and valid id field could lead to remote code execution. Public disclosures and multiple ent...
PT-2019-11429
Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack Confluence plugin versions prior to 1.8.1.3 Description: The issue allows for Server Side Template Injection. An attacker can add an Issue macro to a page in Confluence and use a combination of a valid id field and speciall...
CVE-2019-10100: Improper Control of Generation of Code
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...