2586 matches found
RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2664)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:2664 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and do...
Atlassian Confluence 7.5.x < 7.5.1 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypas...
Atlassian Confluence < 7.4.5 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypas...
GHSA-VJQW-R3WW-WJ2W Expression Language Injection in Apache Syncope
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...
Injection in Apache Syncope
Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution RCE was discovered...
CVE-2021-3583
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...
PT-2021-7624
Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in...
Grav CMS 1.7.10 Server-Side Template Injection
Title: Grav CMS 1.7.10 - Server-Side Template Injection SSTI Authenticated Author: enox Date: 06-06-2021 Vendor: https://getgrav.org/ Software Link: https://getgrav.org/download/core/grav-admin/1.7.10 Vulnerable Versions: Grav CMS 1.7.10 CVE: CVE-2021-29440 Credits:...
Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated) Exploit
Title: Grav CMS 1.7.10 - Server-Side Template Injection SSTI Authenticated Author: enox Vendor: https://getgrav.org/ Software Link: https://getgrav.org/download/core/grav-admin/1.7.10 Vulnerable Versions: Grav CMS 1.7.10 CVE: CVE-2021-29440 Credits:...
Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
Title: Grav CMS 1.7.10 - Server-Side Template Injection SSTI Authenticated Author: enox Date: 06-06-2021 Vendor: https://getgrav.org/ Software Link: https://getgrav.org/download/core/grav-admin/1.7.10 Vulnerable Versions: Grav CMS 1.7.10 CVE: CVE-2021-29440 Credits:...
Grav CMS 1.7.10 - Code Execution Vulnerabilities
In the lineage of most recent flat-file PHP CMS, Grav CMS is a modern web platform to build fast, safe and extensible websites. It uses a modern technology stack with Twig, Symfony and Doctrine, and offers an administration dashboard that allows managing the whole website structure, pages, static...
express-hbs 代码注入漏洞
handlebars is a semantic Web template system. An information disclosure vulnerability exists in express-hbs that stems from mixing pure template data with engine configuration options via the Express rendering API. Layout parameters may trigger a file disclosure vulnerability in downstream...
CVE-2021-30214
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...
CVE-2021-30214
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...
Design/Logic Flaw
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...
CVE-2021-30214
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...
CVE-2021-30214
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...
CVE-2021-30214
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection at /knowage/restful-services/signup/update through the name parameter. Root cause: the system stores client templates via the name parameter, enabling injection. Impact per sources is limited to client-side template manipula...
