905 matches found
Updated php-smarty package fixes security vulnerabilities
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode CVE-2021-26119. Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring CVE-2021-26120...
WeedCMS 5.6 Build 20111203 Exists Logic Flaw Vulnerability
Weed website management system WEEDCMS is a content management system developed independently by Weed based on PHP + MYSQL. Oriented enterprises , individuals , small portals and other small and medium-sized site use and development . Using the international popular Smarty engine and agile JQuery...
GLSA-202105-06 : Smarty: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202105-06 Smarty: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Smarty template engine. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE...
Smarty: Multiple vulnerabilities
Background Smarty is a template engine for PHP. Description Multiple vulnerabilities have been discovered in Smarty template engine. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
PT-2021-6745 · Smarty +2 · Smarty +2
Name of the Vulnerable Software and Affected Versions: Smarty versions prior to 3.1.42 and 4.0.2 Description: The issue is related to the incorrect handling of code generation in the Smarty template engine for PHP. This allows template authors to run arbitrary PHP code by crafting a malicious mat...
GHSA-W5HR-JM4J-9JVQ Sandbox escape through template_object in smarty
Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher...
Sandbox escape through template_object in smarty
Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on Smarty Security features should upgrade as soon as possible. Please upgrade to 3.1.39 or higher...
GHSA-3RPF-5RQV-689Q PHP Code Injection by malicious function name in smarty
Template authors could inject php code by choosing a malicous function name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher...
PHP Code Injection by malicious function name in smarty
Template authors could inject php code by choosing a malicous function name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher...
Privilege Escalation
smarty/smarty is vulnerable to privilege escalation. An attacker is able to access smarty.templateobject in sandbox mode...
Remote Code Execution (RCE)
Smarty is vulnerable to remote code execution. The library does not properly handle the illegal function names in function name='blah'/function, allowing a malicious user to inject and execute arbitrary commands...
DEBIAN-CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
DEBIAN-CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
UBUNTU-CVE-2021-26119
Smarty before 3.1.39 allows a Sandbox Escape because $smarty.templateobject can be accessed in sandbox mode...
