34 matches found
USN-7377-1: Smarty vulnerability
It was discovered that Smarty did not properly sanitize template file names. An attacker could possibly use this issue to cause Smarty to crash, resulting in a denial of service, or possibly execute arbitrary code...
ROS-20250212-09
A vulnerability in the PHP Smarty templating engine is related to incorrect input validation when processing the attribute "extends-tag" attribute. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary PHP code on the target system. arbitrary PHP code on t...
MGASA-2022-0226 Updated php-smarty packages fix security vulnerability
Template authors could inject php code by choosing a malicious block name or include file name. CVE-2022-29221...
Smarty path traversal vulnerability
New Digital Group Smarty is a template engine written in PHP by New Digital Group. A path traversal vulnerability exists in the 'SmartySecurity::isTrustedResourceDir' function in New Digital Group Smarty versions prior to 3.1.33, which stems from the program's failure to adequately filter templat...
DEBIAN-CVE-2018-16831
Smarty before 3.1.33-dev-4 allows attackers to bypass the trusteddir protection mechanism via a file:./../ substring in an include statement...
MGASA-2018-0118 Updated php-smarty packages fix security vulnerability
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch or display functions on custom resources that does not sanitize template nameCVE-2017-1000480...
UBUNTU-CVE-2017-1000480
Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch or display functions on custom resources that does not sanitize template name...
DEBIAN-CVE-2010-4725
Smarty before 3.0.0 RC3 does not properly handle an on value of the asptags option in the php.ini file, which has unspecified impact and remote attack vectors...
CVE-2010-4727
Smarty before 3.0.0 beta 7 does not properly handle the tags, which has unspecified impact and remote attack vectors...
CVE-2009-5053
Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file...
CVE-2010-4723
Smarty before 3.0.0, when security is enabled, does not prevent access to the 1 dynamic and 2 private object members of an assigned object, which has unspecified impact and remote attack vectors...
CVE-2009-5053
Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file...
