855 matches found
Atlassian Confluence Widget Connector Macro Velocity Template Injection Exploit
Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is not...
Confluence Server Remote Code Execution Vulnerability-vulnerability warning-the black bar safety net
Atlassian company for Confluence Server and Data Center products used in the widgetconnecter Assemblyversion Network Vine CRS/ARS products have full support for the vulnerability detection and verification, 网藤用户可直接登陆www.riskivy.com for verification. ! A, scope of impact Product Confluence Server...
Atlassian Confluence Widget Connector Macro Velocity Template Injection
Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is...
Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses. According to a lawsuit filed...
Repokid - AWS Least Privilege For Distributed, High-Velocity Deployment
Repokid uses Access Advisor provided by Aardvark to remove permissions granting access to unused services from the inline policies of IAM roles in an AWS account. Getting Started Install mkvirtualenv repokid git clone [email protected]:Netflix/repokid.git cd repokid python setup.py develop...
[SECURITY] Fedora 28 Update: plexus-archiver-3.5-6.fc28
The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...
VPNFilter Malware Impact Larger Than Previously Thought
Researchers say the impact of the VPNFilter malware discovered last month is larger than originally reported. On Wednesday, Cisco Talos researchers said they now believe the malware has infected twice the number of router brands than previously stated. They added that VPNFilter also delivers a mo...
DEBIAN-CVE-2017-12951
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash via a crafted gig file...
UBUNTU-CVE-2017-12951
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash via a crafted gig file...
libgig Denial of Service Vulnerability (CNVD-2017-27702)
libgig is a C++ library for loading, modifying and creating Gigasamlier and DLS files. A denial of service vulnerability exists in the 'gig::DimensionRegion::CreateVelocityTable' function of the gig.cpp file in libgig version 4.0.0. A remote attacker can exploit this vulnerability to cause a deni...
Apache Roller Execute Arbitrary java Code Vulnerability
Apache Roller is the United States Apache Apache Software Foundation's set of feature-rich multi-user blogging platform. A security vulnerability exists in the weblog page template in Apache Roller versions 5.1 through 5.1.1. The vulnerability can be exploited by a remote attacker to execute...
CVE-2015-0249
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...
Design/Logic Flaw
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...
CVE-2015-0249: Improper Control of Generation of Code
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...
CVE-2015-0249
The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language aka VTL...
PT-2017-6442
Name of the Vulnerable Software and Affected Versions Apache Roller versions 5.1 through 5.1.1 Description The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language VTL in the weblog page template...
Mis-configuration of Apache Velocity template engine used to send emails in GigaCC OFFICE
Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains mis-configuration of Apache Velocity template engine which is used to send emails. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and...
Liferay Portal Command Execution Vulnerability
Liferay is a J2EE-based portal solution that uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, an enterprise collaboration platform, a social network, and more. A command execution vulnerability exists in Liferay Portal versions prior to 6.2.1...
Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud
Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...