New Threat Actor 'AeroBlade' Emerges in Espionage Attack on U.S. Aerospace

A previously undocumented threat actor has been linked to a cyber attack targeting an aerospace organization in the U.S. as part of what's suspected to be a cyber espionage mission. The BlackBerry Threat Research and Intelligence team is tracking the activity cluster as AeroBlade. Its origin is...

RCE in Confluence Data Center and Server - CVE-2023-22522

h2. Summary of Vulnerability This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve RCE on an affected instance. Confluence Data Center and...

CVE-2023-44381 October CMS safe mode bypass using Page template injection

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

CVE-2023-44381 October CMS safe mode bypass using Page template injection

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

Exploit for Improper Control of Dynamically-Managed Code Resources in Craftercms Crafter_Cms

CVE-2022-40634: FreeMarker Server-Side Template Injection in C...

Template Injection

October CMS is vulnerable to Template Injection. The vulnerability is caused by a crafted request which includes PHP code in the CMS template, where an authenticated backend user possessing the editor.cmspages, editor.cmslayouts, or editor.cmspartials can execute arbitrary PHP code even when the...

Server Side Template Injection

October CMS is vulnerable to Server Side Template Injection. The vulnerability is due improper sandboxing of twig code, where an authenticated backend user possessing the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions, can execute PHP code even when cms.safemode being...

GHSA-Q22J-5R3G-9HMH October CMS safe mode bypass using Page template injection

Impact An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.safemode being enabled can craft a special request to include PHP code in the CMS...

CVE-2023-49214

Usedesk before 1.7.57 allows chat template injection...

CVE-2023-49214

Usedesk before 1.7.57 allows chat template injection...

CVE-2023-49214

Usedesk before 1.7.57 allows chat template injection...

CVE-2023-49214

Usedesk before 1.7.57 allows chat template injection...

Usedesk Security Breach

Usedesk is a system for bookkeeping and processing applications from Usedesk, Inc. A security vulnerability exists in Usedesk versions prior to 1.7.57 that stems from the presence of a template injection vulnerability...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

Design/Logic Flaw

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS 120...

CVE-2023-49061

CVE-2023-49061 concerns Firefox for iOS prior to version 120, where the Reader Mode fails to neutralize HTML tags, enabling an attacker to perform HTML template injection and potentially exfiltrate user information. Affected software: Firefox for iOS