CVE-2020-13959 Velocity Tools XSS Vulnerability

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

Iteris Apache Velocity 跨站脚本漏洞

Iteris Apache Velocity is a software application from the United States Iteris. It is used to create and maintain open source software features related to the Apache Velocity Engine. A security vulnerability exists in Apache Velocity 3.1, which can be exploited by an attacker to steal a session...

PT-2021-9683

Name of the Vulnerable Software and Affected Versions Apache Velocity Tools versions prior to 3.1 Description The default error page for VelocityView in Apache Velocity Tools reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in...

Mis-configuration of Apache Velocity template engine used to send emails in GigaCC OFFICE

Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains mis-configuration of Apache Velocity template engine which is used to send emails. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and...