Stored XSS Leads To Session Hijacking

Description Hello everyone, During my testing on openemr at the demo available here https://demo.openemr.io/openemr, I found a Stored XSS on filename at Uploading Documents Templates which is found on Administration tab, what makes this Stored XSS really severe is the ability of stealing session...

S1EM - This Project Is A SIEM With SIRP And Threat Intel, All In One

Today, cyber attacks are more numerous and cause damage in companies. Nevertheless, many software products exist to detect cyber threats. The S1EM solution is based on the principle of bringing together the best products in their field, free of charge, and making them quickly interoperable. S1EM ...

CVE-2021-45968

creationtimestamp| type| source ---|---|--- 2022-03-18 11:22:27+00:00| seen| https://t.me/cibsecurity/39191 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-45968.yaml...

CVE-2021-44260

creationtimestamp| type| source ---|---|--- 2022-03-17 15:21:31+00:00| seen| https://t.me/cibsecurity/39131 2024-11-06 23:25:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-44260.yaml...

Template Injection in Email Templates - bypass of mitigation via XStream - CVE-2022-36799

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

Jira Software Server Template RCE via Email Templates feature

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Software Server and Data Center allow a system administrator to execute arbitrary code via a remote code execution in the...

CVE-2022-24609

Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/templatemanage.php, an attacker can write an arbitrary shell file...

CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2021-43944

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...

CVE-2021-43944

Atlassian Jira Server/Data Center is affected by CVE-2021-43944: Template Injection in the Email Templates feature can lead to Remote Code Execution when an attacker has System Administrator permissions. Affected versions are before 8.13.15 and, for 8.14.x, before 8.20.3. The issue has been discu...

Atlassian Jira 代码注入漏洞

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira Server and Data Center that could allow a remote attacker with system...

PT-2022-11944 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.13.15 Atlassian Jira Server and Data Center versions 8.14.0 through 8.20.2 Description: The issue is related to a security improvement in the way that Jira Server and Data Center use...

CVE-2021-46703

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment if users can externally control template contents. NOTE: This vulnerability only affects products that are no longer supported by the maintain...

PT-2022-12906 · Antaris · Razorengine

Name of the Vulnerable Software and Affected Versions: Antaris RazorEngine versions through 4.5.1-alpha001 Description: An attacker can execute arbitrary .NET code in a sandboxed environment if users can externally control template contents. This issue affects products that are no longer supporte...

Open OnDemand has an unspecified vulnerability

Osc Open OnDemand is an application of the Osc open source organization in the United States. Open OnDemand has a security vulnerability that could be exploited by an attacker to provide crafted input in job templates...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-20143)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. A cross-site scripting vulnerability exists in versions prior to JetBrains YouTrack 2021.4.31698, which stems from a lack of data validation filtering of user-supplied data and output...

WordPress WP Page Templates plugin <= 1.1.12 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Page Templates plugin versions = 1.1.12. Solution Update the WordPress WP Page Templates plugin to the latest available version at least 1.1.13...

WordPress SKT Templates – Elementor & Gutenberg templates plugin <= 4.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SKT Templates – Elementor & Gutenberg templates plugin versions = 4.2. Solution Update the WordPress SKT Templates – Elementor & Gutenberg templates plugin to the latest available version at least 4.3...

WordPress Ultimate Gutenberg – Custom Block Templates plugin <= 2.5.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Gutenberg – Custom Block Templates plugin versions = 2.5.1. Solution No patched version available...

WordPress SKT Templates – Elementor & Gutenberg templates plugin <= 4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SKT Templates – Elementor & Gutenberg templates plugin versions = 4.2. Solution Update the WordPress SKT Templates – Elementor & Gutenberg templates plugin to the latest available version at least 4.3...