1062 matches found
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
Server-Side Template Injection (SSTI)
opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...
GHSA-XRH7-2GFQ-4RCQ openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
PT-2024-27131
Name of the Vulnerable Software and Affected Versions OpenCart version 4.0.2.3 Description The issue is related to a Server-Side Template Injection SSTI vulnerability via the Theme Editor Function. This allows attackers to execute arbitrary code by injecting a crafted payload. Recommendations For...
PT-2024-28841 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: opencart version 4.0.2.3 Description: A Server-Side Template Injection SSTI vulnerability in the edit theme function allows attackers to execute arbitrary code via injecting a crafted payload. Recommendations: For version 4.0.2.3, at the...
PT-2024-4769 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.4.0 through 2.9.3 Description: This vulnerability allows authenticated DAG authors to craft a malicious doc md parameter, potentially leading to arbitrary code execution within the scheduler context. This bypasses...
CVE-2024-40420
CVE-2024-40420 is rejected/not used and does not represent an active vulnerability entry.
Server-Side Template Injection
airbyte is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of user input in the connection builder, allowing attackers to execute arbitrary code on the server...
Exploit for Code Injection in Rejetto Http_File_Server
An unauth SSTI in the Rejetto HTTP File Server HFS. Original...
CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...
CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
PT-2024-27678 · Unknown · Strongshop
Name of the Vulnerable Software and Affected Versions: StrongShop version 1.0 Description: A Server-Side Template Injection SSTI issue was found in the /shippingOptionConfig/index.blade.php component. Recommendations: For StrongShop version 1.0, consider restricting access to the vulnerable...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
CVE-2024-37621
CVE-2024-37621 affects StrongShop v1.0, with a Server-Side Template Injection (SSTI) vulnerability in the component /shippingOptionConfig/index.blade.php. The connected sources explicitly identify the vulnerable element and software version, but do not provide any confirmed exploit details, affec...