CVE-2023-2017 Improper Control of Generation of Code in Twig Rendered Views in Shopware

Server-side Template Injection SSTI in Shopware 6 = v6.4.20.0, v6.5.0.0-rc1 = v6.5.0.0-rc4, affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in...

GHSA-582P-2FPG-X226 Microweber vulnerable to command injection

microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution...

Microweber vulnerable to command injection

microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution...

Pentaho BA Server EE 9.3.0.0-428 Server-Side Template Injection / Remote Code Execution

Pentaho BA Server EE version 9.3.0.0-428 suffers from a remote code execution vulnerability via a server-side template injection flaw. Title: Pentaho BA Server EE 9.3.0.0-428 - RCE via Server-Side Template Injection Unauthenticated Author: dwbzn Vendor: https://www.hitachivantara.com/ Software...

Pentaho BA Server EE 9.3.0.0-428 Server-Side Template Injection / Remote Code Execution

Title: Pentaho BA Server EE 9.3.0.0-428 - RCE via Server-Side Template Injection Unauthenticated Author: dwbzn Date: 2022-04-04 Vendor: https://www.hitachivantara.com/ Software Link: https://www.hitachivantara.com/en-us/products/lumada-dataops/data-integration-analytics/download-pentaho.html...

Microweber 命令注入漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A command injection vulnerability exists in Microweber versions prior to 1.3.3, which...

Atlassian Jira < 8.13.12 Server-Side Template Injection Vulnerability

According to its self-reported version number, the Atlassian Jira application running on the remote host is 8.13.12 or 8.14.x 8.19.1. It is, therefore, affected by a vulnerability that when using the Jira Service Management addon may allow remote attackers with JIRA Administrators access to execu...

Atlassian Jira 8.14.x < 8.19.1 Server-Side Template Injection Vulnerability

According to its self-reported version number, the Atlassian Jira application running on the remote host is 8.13.12 or 8.14.x 8.19.1. It is, therefore, affected by a vulnerability that when using the Jira Service Management addon may allow remote attackers with JIRA Administrators access to execu...

Server Side Template Injection

Description alf-event is vulnerable to Server Side Template Injection via angular Proof of Concept VIDEO: With an authenticated user, access the admin panel. Create a organization and then Go to users and create new user having username 77 in that organization Now login with this username and you...

CVE-2023-26092

Liima before 1.17.28 allows server-side template injection...

CVE-2023-26092

Liima up to version 1.17.27 is vulnerable to server-side template injection. The issue arises in Liima’s templating flow and can lead to arbitrary code execution or access to sensitive data as indicated by the CVE details (high impact). Remediation: upgrade to Liima 1.17.28 or later (the fixed ve...

CVE-2023-26092

Liima before 1.17.28 allows server-side template injection...

CVE-2023-26092

Liima before 1.17.28 allows server-side template injection...

CVE-2023-26092

Liima before 1.17.28 allows server-side template injection...

SSTImap - Automatic SSTI Detection Tool With Interactive Interface

SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection...

Froxlor 2.0.6 Remote Command Execution via Arbitrary File Write and Server Side Template Injection

Description Froxlor 2.0.6 Stable is suffering from Remote Command Execution that was achieved by chaining two bugs, the first one is an arbitrary file write on the logging feature, which allows an authenticated attacker to point the log file to any writable path even if it was the web server...

PT-2022-28088 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.3.1 Description: The issue concerns SSTI attacks on code Templates in JetBrains IntelliJ IDEA. SSTI stands for Server-Side Template Injection, which is a type of vulnerability that allows attacke...

RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

Impact The user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template Injection RCE. Patches Update to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patch Workarounds Apply...

Remote Code Execution (RCE)

pimcore is vulnerable to remote code execution. The vulnerability exists in multiple functions of Mail.php and Text.php due to the user controlled twig template rendering which allows an attacker to inject and execute malicious query parameters to the server-side template...

CVE-2022-39365

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contain...