2585 matches found
vulhub
It is an offensive tool for vulnerable environments. The repository contains a collection of pre-built vulnerable docker environments, including Flask SSTI, Apache Parsing Vulnerability, and more. The tool is designed to be used for testing and training purposes, allowing users to practice...
vulhub
This is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for testing and training purposes. The primary CVE ID is not specified, but it includes various vulnerable environments based on Docker-Compose. The target product/service or framework is not...
Chinese APT group targets India and Hong Kong using new variant of MgBot malware
This blog post was authored by Hossein Jazi and Jérôme Segura On July 2, we found an archive file with an embedded document pretending to be from the government of India. This file used template injection to drop a malicious template which loaded a variant of Cobalt Strike. One day later, the sam...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not explicitly stated, but it appears to be a collection of various vulnerabilities, including but not limited to, SQL injection, cross-site scripting XSS, and server-side templa...
Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware
Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-...
vulhub
It is an offensive tool for vulnerable environments. The repository contains a collection of pre-built vulnerable docker environments, including a Flask SSTI Server-Side Template Injection vulnerability environment. The tool is designed to be easy to use, requiring only two simple commands to...
CVE-2020-11994
A flaw was found in camel. Camel's templating components are suseptable to Server-Side Template Injection and arbitrary file disclosure. The highest threat from this vulnerability is to data confidentiality...
Server-Side Template Injection
camel-robotframework is vulnerable to server-side template injection. An attacker is able to inject and execute arbitrary code via server-side templates...
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
Design/Logic Flaw
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
CVE-2020-11994
CVE-2020-11994 is a Server-Side Template Injection in the Apache Camel templating component used by Oracle Enterprise Manager Cloud Control Base Platform (13.4.0.0), specifically in the Reporting Framework. The vulnerability enables arbitrary file disclosure and high-impact data exposure due to C...
CVE-2020-11994
Server-Side Template Injection and arbitrary file disclosure on Camel templating components...
Scant3R - Web Security Scanner
ScanT3r - Web Security Scanner / / / / / \ / / / / / / / / / / // // / / / / / / / / ///,// /// /// Coded By : Khaled Nassar @knassar702 Detect This vulnerabilities Remote Code Execution Linux XSS Reflected Template Injection Jinja2 ERB Java Twig Freemarker SQlInjection ScreenShot: GIF...
Server Side Template Injection Payloads
Server-side template injection is when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Template engines are designed to generate web pages by combining fixed templates with volatile data. Server-side template...
CVE-2020-14172
This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...
CVE-2020-14172
CVE-2020-14172 concerns Atlassian Jira Server/Data Center vulnerability where insecure deserialization via server-side Velocity templates enabled remote code execution. The affected versions are Jira Server/Data Center before 7.13.0, 8.0.x before 8.5.0, and 8.6.x before 8.8.1. The issue is addres...
CVE-2020-14172
This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote...
CVE-2020-4027
Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version...
SecureAuth IdP Client Template Injection Vulnerability
SecureAuth IdP is a suite of identity management solutions from SecureAuth USA. The product supports features such as two-factor authentication and single sign-on. A security vulnerability exists in the SecureAuth.aspx file in SecureAuth IdP version 9.3.0. An attacker can exploit the vulnerabilit...