678 matches found
CVE-2025-12107
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...
CVE-2025-12107
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...
CVE-2025-12107
CVE-2025-12107 is linked to a server-side template injection (SSTI) vulnerability in a vulnerable third-party Velocity template engine used by WSO2 Identity Server. An attacker with administrative privileges can inject and execute arbitrary template code on the server, potentially leading to remo...
CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...
CVE-2025-12107 Server-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code Execution
The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker...
CVE-2025-12107
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and...
PT-2026-20796
Name of the Vulnerable Software and Affected Versions versions prior to Feb. 19, 2026 Description A security flaw exists due to the use of a vulnerable third-party Velocity template engine. An attacker with administrative privileges can inject malicious template syntax, potentially leading to...
WSO2 Identity Server 安全漏洞
WSO2 Identity Server is an identity authentication server developed by the American company WSO2. WSO2 Identity Server has a security vulnerability that stems from the use of a vulnerable third-party Velocity template engine. This vulnerability could allow attackers with administrative privileges...
Exploit for Injection in Apache Solr
Apache-Solr-RCE-CVE-2019-17558 🛡️ Apache Solr Remote Code E...
CVE-2025-31990
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
CVE-2025-31990
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
CVE-2025-31990 HCL DevOps Velocity is susceptible to a Denial of Service vulnerability
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
EUVD-2025-206899
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
CVE-2025-31990
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
CVE-2025-31990
The CVE-2025-31990 entry concerns HCL Velocity where rate limiting on certain API calls is not enforced, enabling Denial of Service (DoS) by attackers sending a high volume of requests. The Red Hat/NVD/CVE listings confirm the affected product is HCL Velocity and that the issue leads to resource ...
CVE-2025-31990 HCL DevOps Velocity is susceptible to a Denial of Service vulnerability
Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service DoS attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability ...
HCL Velocity 安全漏洞
HCL Velocity is a value stream management and release platform developed by the Indian company HCL. There is a security vulnerability in HCL Velocity, which stems from the lack of rate limits being enforced for certain API calls, potentially leading to denial-of-service attacks...
[SECURITY] Fedora 42 Update: gpsd-3.25-17.fc42
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...
[SECURITY] Fedora 43 Update: gpsd-3.26.1-6.fc43
gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...
CVE-2023-29521
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of...