5385 matches found
PT-2023-16878 · Unknown · Insightcloudsec
Name of the Vulnerable Software and Affected Versions: InsightCloudSec versions prior to 23.2.1 Description: An authenticated attacker can leverage an exposed resource.db accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved...
nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS
A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to a denial of service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This flaw allows attackers to exhaust system resources, leading to a denial of...
nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option
A flaw was found in nodejs-handlebars. A unescaped value in the JavaScriptCompiler.prototype.depthedLookup function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system e.g. browser or server when the template is compiled with the...
nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution
A flaw was found in nodejs-handlebars, where affected versions of handlebars are vulnerable to arbitrary code execution. The package lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript into the system. This issue is used to...
nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option
A flaw was found in nodejs-handlebars. A missing check when getting prototype properties in the template function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system e.g. browser or server when the template is compiled with the...
Path Traversal
swig-templates is vulnerable to Path Traversal. The vulnerability exists due to improper template restrictions which allows an attacker to access and read the files outside the restricted directory through the include or extends tags...
GHSA-2RQ5-699J-X7P6 Arbitrary local file read vulnerability during template rendering
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...
1095h-cli (1.0.1), 5coder-pages (0.2.0) +547 more potentially affected by CVE-2023-25345 via swig-templates (>=2.0.2, <=2.0.3)
swig-templates NPM version =2.0.2, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.0-beta.1, =0.0.1-alpha.0, =0.0.1 and more Source cves: CVE-2023-25345 Source advisory: OSV:GHSA-2RQ5-699J-X7P6...
Arbitrary local file read vulnerability during template rendering
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...
CVE-2023-25344
An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prototype anonymous function...
CVE-2023-25345
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...
Directory traversal
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...
swig 安全漏洞
swig is a JavaScript template engine open-sourced by node-swig. A security vulnerability exists in swig-templates thru version 2.0.4 and swig thru version 1.4.2, which originated from a vulnerability that allows an attacker to execute arbitrary code via a crafted Object.prototype anonymous functi...
PT-2023-20029 · Swig +1 · Swig +1
Name of the Vulnerable Software and Affected Versions: swig-templates versions 2.0.4 and earlier swig versions 1.4.2 and earlier Description: An issue allows attackers to execute arbitrary code via crafted Object.prototype anonymous function. Recommendations: For swig-templates versions 2.0.4 and...
PT-2023-20030 · Swig +1 · Swig +1
Name of the Vulnerable Software and Affected Versions: swig-templates versions 2.0.4 and earlier swig versions 1.4.2 and earlier Description: A directory traversal issue allows attackers to read arbitrary files via the include or extends tags. This can be exploited by attackers to access sensitiv...
CVE-2023-25344
CVE-2023-25344 affects swig-templates <= 2.0.4 and swig
CVE-2023-25345
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...
CVE-2023-25345
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags...