[SECURITY] Fedora 28 Update: plexus-archiver-3.5-6.fc28

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

VPNFilter Malware Impact Larger Than Previously Thought

Researchers say the impact of the VPNFilter malware discovered last month is larger than originally reported. On Wednesday, Cisco Talos researchers said they now believe the malware has infected twice the number of router brands than previously stated. They added that VPNFilter also delivers a mo...

DEBIAN-CVE-2017-12951

The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash via a crafted gig file...

UBUNTU-CVE-2017-12951

The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash via a crafted gig file...

libgig Denial of Service Vulnerability (CNVD-2017-27702)

libgig is a C++ library for loading, modifying and creating Gigasamlier and DLS files. A denial of service vulnerability exists in the 'gig::DimensionRegion::CreateVelocityTable' function of the gig.cpp file in libgig version 4.0.0. A remote attacker can exploit this vulnerability to cause a deni...

Apache Roller Execute Arbitrary java Code Vulnerability

Apache Roller is the United States Apache Apache Software Foundation's set of feature-rich multi-user blogging platform. A security vulnerability exists in the weblog page template in Apache Roller versions 5.1 through 5.1.1. The vulnerability can be exploited by a remote attacker to execute...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

Design/Logic Flaw

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

CVE-2015-0249

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...

Mis-configuration of Apache Velocity template engine used to send emails in GigaCC OFFICE

Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains mis-configuration of Apache Velocity template engine which is used to send emails. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and...

Liferay Portal Command Execution Vulnerability

Liferay is a J2EE-based portal solution that uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, an enterprise collaboration platform, a social network, and more. A command execution vulnerability exists in Liferay Portal versions prior to 6.2.1...

Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud

Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...

Design/Logic Flaw

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

CVE-2010-5327

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

CVE-2010-5327

CVE-2010-5327 affects Liferay Portal up to version 6.2.10. The issue is a remote code execution via a crafted Velocity template, enabling remote authenticated users to execute arbitrary shell commands. The connected sources corroborate a velocity/template-based command injection in Liferay Portal...

tplmap - Automatic Server-Side Template Injection Detection and Exploitation Tool

Tplmap short for Template Mapper is a tool that automate the process of detecting and exploiting Server-Side Template Injection vulnerabilities SSTI. This can be used by developers, penetration testers, and security researchers to detect and exploit vulnerabilities related to the template injecti...

Atlassian HipChat for Jira Plugin Velocity 模版注入

No description provided by source...

Atlassian HipChat for Jira Plugin - Velocity Template Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 "Atlassian HipChat for Jira Plugin Velocity Template Injection", 'Description' = %q Atlassian Hipchat is a web service...

Atlassian HipChat for Jira Plugin Velocity Template Injection Exploit

Atlassian Hipchat is a web service for internal instant messaging. A plugin is available for Jira that allows team collaboration at real time. A message can be used to inject Java code into a Velocity template, and gain code execution as Jira. Authentication is required to exploit this...

Atlassian HipChat for Jira Plugin Velocity Template Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 "Atlassian HipChat for Jira Plugin Velocity Template Injection", 'Description' = %q Atlassian Hipchat is a web service...