CVE-2023-37897

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection SSTI vulnerability. The fix for another SSTI vulnerability using "|map", "|filter" and "|reduce" twigs implemented in the commit "71bbed1" introduces bypass of the denylist due to incorrect return...

CVE-2023-37897: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection SSTI vulnerability. The fix for another SSTI vulnerability using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value fr...

Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution

Microsoft Internet Explorer 6 - Codebase Double Backslash Local Zone File Execution source: https://www.securityfocus.com/bid/10344/info A vulnerability has been reported that may potentially permit HTML documents to gain unauthorized access to local resources by using specific syntax when...