PT-2022-13544 · Sqlpad · Sqlpad

Name of the Vulnerable Software and Affected Versions: sqlpad versions prior to 6.10.1 Description: The issue is related to template injection in the connection test endpoint, which can lead to remote code execution RCE. This problem has been identified in the GitHub repository sqlpad/sqlpad. The...

GHSA-M3XV-X3PH-MQ22 Server-side Template Injection in nystudio107/craft-seomatic

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header...

Server-side Template Injection in nystudio107/craft-seomatic

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header...

Template injection in connection test endpoint leads to RCE

Description Please enter a description of the vulnerability. Proof of Concept Run a local docker instance sh sudo docker run -p 3000:3000 --name sqlpad -d --env SQLPADADMIN=admin --env SQLPADADMINPASSWORD=admin sqlpad/sqlpad:latest Navigate to http://localhost:3000/ Click on Connections-Add...

CVE-2021-44618

A Server-side Template Injection SSTI vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header...

Nystudio107 Seomatic 代码注入漏洞

Nystudio107 Seomatic is a comprehensive, powerful and flexible turnkey SEO system in the USA. Facilitates modern SEO best practices and implementation of Craft CMS 3. A security vulnerability exists in Nystudio107 Seomatic version 3.4.12, which stems from a lack of filtering and escaping of...

CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2021-43944

Atlassian Jira Server/Data Center is affected by CVE-2021-43944: Template Injection in the Email Templates feature can lead to Remote Code Execution when an attacker has System Administrator permissions. Affected versions are before 8.13.15 and, for 8.14.x, before 8.20.3. The issue has been discu...

Atlassian Jira 代码注入漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira Server and Data Center that could allow a remote attacker with system...

Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability

Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution...

JetBrains YouTrack Server-Side Template Injection Vulnerability (CNVD-2022-17758)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack is vulnerable to server-side template injection, which can be exploited by attackers to perform SSTI server-side template injection attacks...

Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-3583)

Summary IBM Elastic Storage System is shipped with ansible, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2021-3583 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary commands on the system, caused by template injecti...

CVE-2022-24442

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2022-24442

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

Sql injection

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI Server-Side Template Injection via FreeMarker templates...

CVE-2022-24442

JetBrains YouTrack (pre-2021.4.40426) is affected by SSTI via FreeMarker templates. The issue, CVE-2022-24442, allows server-side template injection and may enable remote code execution; the fix is to update to 2021.4.40426 or later. A public exploit PoC exists on GitHub outlining the RCE possibi...

PT-2022-16700 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2021.4.40426 Description: The issue concerns Server-Side Template Injection SSTI via FreeMarker templates. This allows for potential exploitation. No information is provided about the estimated number of...

JetBrains YouTrack 代码注入漏洞

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack is vulnerable to server-side template injection, which can be exploited by attackers to perform SSTI server-side template injection attacks...