855 matches found
CVE-2012-1826: Undefined Security Weakness
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted 1 XSLT or 2 Velocity template...
PT-2012-3571
Name of the Vulnerable Software and Affected Versions dotCMS versions 1.9 through 1.9.5.1 Description The issue allows remote authenticated users to execute arbitrary Java code via crafted templates, specifically 1 XSLT or 2 Velocity templates. Recommendations For dotCMS versions 1.9 through...
dotCMS template permissions allow arbitrary code execution
Overview The dotCMS content management system version 1.9 and possibly earlier versions, contains a vulnerability that allows users with the appropriate permissions to create a malicious template with arbitrary code. Description An authenticated dotCMS user with the permissions required to author...
VELOCITY local code execution vulnerability-vulnerability warning-the black bar safety net
by emptiness prodigal heart velocity is a J2EE MVC architecture the most commonly used presentation layer template file, due to the excellent performance, very much of the J2EE Application, use this template. Usually when in use, and other framework-binding, the most common framework is struts2,...
GeneralUtil.htmlEscapeQuotes should be annotated HtmlSafe
The GeneralUtil.htmlEscapeQuotes method outputs HTML and thus should be annotated as @HtmlSafe. Not doing so causes its output to be double escaped when automatic escaping is enabled for the plugin/velocity template...
GeneralUtil.htmlEscapeQuotes should be annotated HtmlSafe
The GeneralUtil.htmlEscapeQuotes method outputs HTML and thus should be annotated as @HtmlSafe. Not doing so causes its output to be double escaped when automatic escaping is enabled for the plugin/velocity template...
Fedora 14 : kernel-2.6.35.4-28.fc14 (2010-14832)
Fix possible local privilege escalation on x8664 systems CVE-2010-3081, CVE-2010-3301. - NOTE: All users should update because of this bug. Fix denial of service attack with large argument lists. Add support for perl and python scripting to perf. Nouveau video driver fixes : - fix oops in acpi ed...
CVE-2008-7084
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers to read arbitrary files via a .. dot dot in the URI...
CVE-2008-7084
CVE-2008-7084 describes a directory traversal vulnerability in the web server 1.0 of Velocity Security Management System. An attacker can read arbitrary files by using a “..” in the URI. The NVD entry lists a CVSSv2 base score of 5.0 (Medium) with network access, low attack complexity, no authent...
CVE-2008-7084: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers to read arbitrary files via a .. dot dot in the URI...
The i18n in velocity templates does not auto html encode parameters
All the getText methods on com.atlassian.confluence.util.i18n.DefaultI18NBean are anontated as HtmlSafe which means that any parameter which gets passed in as an argument will not be auto html encoded by the Anti-XSS module. The most straight forward way to fix this is to wrap the parameter insid...
The i18n in velocity templates does not auto html encode parameters
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-15548. panel All the getText methods on com.atlassian.confluence.util.i18n.DefaultI18NBean are anontated as HtmlSafe which means...
The i18n in velocity templates does not auto html encode parameters
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-15548. panel All the getText methods on com.atlassian.confluence.util.i18n.DefaultI18NBean are anontated as HtmlSafe which mean...
XSS in the Widget Connector
I've been working with the widget connector today and reading through the code when I noticed that the media uris are not being handled securely. try this: widget:url=youtube.com/v="alert'xss' In general there is not a unified way to prevent issues like this in the widget extensions and it is up ...
XSS in the Widget Connector
I've been working with the widget connector today and reading through the code when I noticed that the media uris are not being handled securely. try this: widget:url=youtube.com/v="alert'xss' In general there is not a unified way to prevent issues like this in the widget extensions and it is up ...
Velocity web-server 1.0 Directory Traversal File Download Vulnerability
No description provided by source. Digital Security Research Group DSecRG Advisory DSECRG-08-028 Application: Velocity web-server a part of Velocity Security Management System Versions Affected: Old version 1.0 Vendor URL: http://hirschelectronics.com Bugs: Directory traversal File Download...
Velocity web-server 1.0 Directory Traversal File Download Vulnerability
Exploit for unknown platform in category remote exploits ======================================================================= Velocity web-server 1.0 Directory Traversal File Download Vulnerability ======================================================================= Digital Security Researc...
Velocity Web-Server 1.0 - Directory Traversal
Velocity Web-Server 1.0 - Directory Traversal Digital Security Research Group DSecRG Advisory DSECRG-08-028 Application: Velocity web-server a part of Velocity Security Management System Versions Affected: Old version 1.0 Vendor URL: http://hirschelectronics.com Bugs: Directory traversal File...
Velocity Web-Server 1.0 - Directory Traversal
Digital Security Research Group DSecRG Advisory DSECRG-08-028 Application: Velocity web-server a part of Velocity Security Management System Versions Affected: Old version 1.0 Vendor URL: http://hirschelectronics.com Bugs: Directory traversal File Download Exploits: YES Reported: 03.03.2008 Secon...
Velocity安全管理系统HTTP服务器目录遍历漏洞
BUGTRAQ ID: 30261 Hirsch公司的Velocity安全管理系统是用于访问控制和安全操作的管理软件。 Velocity安全管理系统处理畸形用户请求时存在漏洞，远程攻击者可以向Velocity安全管理系统内嵌的WEB服务器提交恶意URL请求执行目录遍历攻击，导致下载服务器上的敏感数据。 Hirsch Electronics Velocity Security Management System 1.0 http://server:port/../../../../../../../../../../../../../etc/passwd...