CVE-2024-6201

HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...

CVE-2024-6201

HaloITSM is affected by a Template Injection vulnerability in the email-generation engine. Affected: HaloITSM versions up to 2.146.1. Impact: leakage of potentially sensitive information. Remediation: apply patches starting from 2.143.61 or upgrade to a version past 2.146.1, as referenced by the ...

CVE-2024-6201 HaloITSM - Emailing Template Injection

HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...

CVE-2024-6201 HaloITSM - Emailing Template Injection

HaloITSM versions up to 2.146.1 are affected by a Template Injection vulnerability within the engine used to generate emails. This can lead to the leakage of potentially sensitive information. HaloITSM versions past 2.146.1 and patches starting from 2.143.61 fix the mentioned vulnerability...

PT-2024-37446 · Haloitsm · Haloitsm

Name of the Vulnerable Software and Affected Versions: HaloITSM versions up to 2.146.1 Description: The issue is related to a Template Injection vulnerability within the engine used to generate emails, which can lead to the leakage of potentially sensitive information. Recommendations: For versio...

CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then...

CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then...

CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then...

GHSA-7726-43HG-M23V OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

Template Injection

org.openidentityplatform.openam, openam-oauth2 is vulnerable to Template Injection. The vulnerability is due to improper template restrictions in the getCustomLoginUrlTemplate function within RealmOAuth2ProviderSettings.java, allowing attackers to inject and execute arbitrary code via the...

CVE-2024-41667

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667

OpenAM

CVE-2024-41667 OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

PT-2024-5297 · Openiam · Openam

Name of the Vulnerable Software and Affected Versions: OpenAM versions 15.0.3 and prior Description: The issue is related to the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java, which is vulnerable to template injection due to its usage of user input. This vulnerability allow...

OpenAM 安全漏洞

OpenAM is an all-in-one access management solution organized by the OpenAM Consortium. It provides authentication, authorization, delegation and federation capabilities. A security vulnerability exists in OpenAM version 15.0.3 and earlier versions, which stems from vulnerability to template...

VulnCheck KEV: CVE-2024-4879

ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely...

Server-Side Template Injection (SSTI)

opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...