Ivanti Velocity License Server 安全漏洞

Ivanti Velocity License Server is an application from Ivanti USA that provides licenses to mobile devices using Velocity or terminal emulation clients. A security vulnerability exists in Ivanti Velocity License Server versions prior to 5.2, which stems from the presence of insecure privileges tha...

Security Bulletin: The IBM® Engineering Lifecycle Management is impacted by vulnerabilties in Apache Velocity

Summary A vulnerability has been identified in Apache Velocity, which is used in IBM Engineering Lifecycle Management - IBM Jazz. This bulletin contains information regarding vulnerabilities and remediation actions. Vulnerability Details CVEID:CVE-2020-13936 DESCRIPTION: Apache Velocity could all...

OPENSUSE-SU-2024:11678-1 velocity-custom-parser-example-2.2-1.1 on GA media

These are all security issues fixed in the velocity-custom-parser-example-2.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11495-1 velocity-1.7-9.3 on GA media

These are all security issues fixed in the velocity-1.7-9.3 package on the GA media of openSUSE Tumbleweed...

RHEL 7 : velocity (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - velocity: arbitrary code execution when attacker is able to modify templates CVE-2020-13936 Note that Nessus has no...

GHSA-C2GG-4GQ4-JV5J XWiki Platform remote code execution from account through UIExtension parameters

Impact Parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and...

GHSA-HF43-47Q4-FHQ5 XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

Impact The HTML escaping of escaping tool that is used in XWiki doesn't escape , which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. To reproduce in an XWiki installation, open...

XWiki Platform 安全漏洞

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform, which stems from a UI extension whose parameters are always interpreted as Velocity code and executed with programmatic privileges. This...

PT-2024-24338 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 13.9-rc-1 through 4.10.18 XWiki Platform versions 13.9-rc-1 through 15.5.3 XWiki Platform versions 13.9-rc-1 through 15.10-rc-1 Description: The XWiki Platform is a generic wiki platform that allows arbitrary remote co...

CVE-2024-24230

Komm.One CMS 10.4.2.14 has a Server-Side Template Injection SSTI vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime.exec followed by an OS command...

CVE-2024-24230

Komm.One CMS 10.4.2.14 has a Server-Side Template Injection SSTI vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime.exec followed by an OS command...

CVE-2024-24230

Komm.One CMS 10.4.2.14 has a Server-Side Template Injection SSTI vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime.exec followed by an OS command...

CVE-2024-24230

Komm.One CMS 10.4.2.14 is affected by a Server-Side Template Injection (SSTI) in the Velocity engine. The underling issue allows an attacker to craft a URL that uses java.lang.Runtime and getRuntime().exec to execute arbitrary OS commands on the server. This CVE-2024-24230 entry is corroborated b...

Fedora: Security Advisory for plexus-velocity (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for plexus-containers (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for velocity (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: velocity-2.3-5.fc40

Velocity is a Java-based template engine. It permits anyone to use the simple yet powerful template language to reference objects defined in Java code. When Velocity is used for web development, Web designers can work in parallel with Java programmers to develop web sites according to the...

[SECURITY] Fedora 40 Update: plexus-resources-1.3.0-4.fc40

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

[SECURITY] Fedora 40 Update: plexus-velocity-2.0-6.fc40

This package provides Plexus Velocity component - a wrapper for Apache Velocity template engine, which allows easy use of Velocity by applications built on top of Plexus container...

[SECURITY] Fedora 40 Update: plexus-i18n-1.0-0.31.b10.4.fc40

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...