1583 matches found
CVE-2024-51755 Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. This issue has...
CVE-2024-51755
Twig is a PHP templating engine. CVE-2024-51755 describes a sandbox vulnerability where an attacker could access attributes of Array-like objects because policy checks were not applied before the __isset() call; the check now occurs via the property policy and then __isset() is invoked. This conf...
Twig 安全漏洞
Twig is a PHP template engine open-sourced by Twig. Twig has a security vulnerability that stems from the fact that when an object is part of an array or parameter list in a sandbox, an attacker can call the toString method on the object even if the security policy does not allow it...
Twig 安全漏洞
Twig is a PHP template engine open-sourced by Twig. A security vulnerability exists in Twig that stems from array-like object properties in the sandbox not being checked against a security policy...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the addattributes Twig function. PoC php Dangerous user supplied variable % set payload = 'alertxss' % Here, Twig escapes it payload Here it is not escaped alertxss' foo Details...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to unsanitized attribute values by the link Twig function. PoC php Dangerous user supplied variable % set payload = 'alertxss' % Here, Twig escapes it payload Here it is not escaped linkpayload,...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the bem Twig function. Note: This is only exploitable when the function is used outside of Drupal. If the Drupal Attribute class exists, the function uses it and it does escape...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization in |markdown filter. An attacker to inject arbitrary JS into the page, by entering Markdown and then renders it with this filter. Note: Filters that use issafe need to make sure the...
Debian: Security Advisory (DSA-5771-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 5771-1] php-twig security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 17, 2024 https://www.debian.org/security/faq -...
Debian: Security Advisory (DLA-3888-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DSA-5771-1 php-twig - security update
Bulletin has no description...
Debian dsa-5771 : php-twig - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5771 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz...
[SECURITY] [DLA 3888-1] php-twig security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3888-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 16, 2024 https://wiki.debian.org/LTS -...
DLA-3888-1 php-twig - security update
Bulletin has no description...
Debian dla-3888 : php-twig - security update
The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3888 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3888-1 [email protected] https://www.debian.org/lts/security/...
CVE-2024-7129
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins...
CVE-2024-7129
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins...
EUVD-2024-48106
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins...
CVE-2024-7129
The CVE-2024-7129 entry concerns the WordPress plugin Appointment Booking Calendar (Simply Schedule Appointments) prior to version 1.6.7.43. The root cause is failure to escape template syntax provided via user input, allowing Twig Template Injection that can lead to remote code execution by high...