5400 matches found
Arbitrary file deletion
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack...
CVE-2021-31231
The CVE affects Grafana Enterprise Metrics versions before 1.2.1 and Grafana Metrics Enterprise 1.2.1. It is a local file disclosure vulnerability triggered when experimental.alertmanager.enable-api is enabled. The HTTP basic auth password_file can be exploited to exfiltrate any file content via ...
CVE-2021-31231
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth passwordfile can be used as an attack vector to send any file content via a webhook. The...
PT-2021-19211 · Grafana · Grafana Enterprise Metrics +1
Name of the Vulnerable Software and Affected Versions: Grafana Enterprise Metrics versions prior to 1.2.1 Metrics Enterprise version 1.2.1 Description: The issue allows for local file disclosure when the experimental.alertmanager.enable-api is used. The HTTP basic auth password file can be...
Cross-Site Scripting in Bootstrap Package
Problem It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. The following templates are affected by the vulnerability:...
GHSA-P48W-VF3C-RQJX Cross-Site Scripting in Bootstrap Package
Problem It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. The following templates are affected by the vulnerability:...
CVE-2021-28150
creationtimestamp| type| source ---|---|--- 2021-04-29 07:23:32+00:00| published-proof-of-concept| https://t.me/pwnwikizhchannel/277 2021-05-07 17:47:11+00:00| published-proof-of-concept| Telegram/kqBIQBnemNZWnppEg-tgAl15KYz4hJuOh5mnJMNA6zFFeg 2023-04-27 09:58:59+00:00| confirmed|...
PT-2021-14447 · Typo3 · Bootstrap Package
Name of the Vulnerable Software and Affected Versions: Bootstrap Package versions 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 Description: The Bootstrap Package for TYPO3 has a cross-site scripting issue when rendering content in the website frontend. A valid backend user account is required to exploi...
Cisco SD-WAN vManage 参数注入漏洞
Cisco SD-WAN vManage is a software from Cisco that provides software-defined networking capabilities. The software provides a way to virtualize the network. A parameter injection vulnerability exists in Cisco SD-WAN vManage Software that stems from improper validation of user-supplied device...
GHSA-MH74-4M5G-FCJX Malicious users could abuse Sydent to control the content of invitation emails
Impact A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. Patches Fixed in 4469d1d, 6b405a8, 65a6e91. Note that these patches include changes to the default email templates. If the...
Malicious users could abuse Sydent to control the content of invitation emails
Impact A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. Patches Fixed in 4469d1d, 6b405a8, 65a6e91. Note that these patches include changes to the default email templates. If the...
Stripo Inc: Ability to use premium templates as free user via https://stripo.email/templates/?utm_source=viewstripo&utm_medium=referral
Summary: Hello, I found security vulnerability in your web application, another business logic. Steps To Reproduce 1. Go to https://stripo.email/templates/?utmsource=viewstripo&utmmedium=referral 2. Choose any premium template and click use in editor 3. Then sign in to save and it is in your...
Joomla! 3.x < 3.9.26 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.9.26. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping allowed Cross-Site Scripting XSS using the logo parameter of the default templates on error pages...
Cross site scripting
An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page...
End of support for Office 2016 and Office 2019
None None...
Updated velocity packages fix security vulnerability
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...
DEBIAN-CVE-2021-23369
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
CVE-2021-23369
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
CVE-2021-23369
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source...
Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution RCE when selecting certain compiling options to compile templates coming from an untrusted source. This vulnerability has been assigned the CVE identifier CVE-2021-23369...