CVE-2017-1000188

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...

CVE-2017-1000228

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile function...

nodejs ejs cross-site scripting vulnerability

nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A cross-site scripting vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.5. A remote attacker can exploit the vulnerability to inject code...

PT-2017-10924

Name of the Vulnerable Software and Affected Versions ejs versions prior to 2.5.3 Description The issue is related to weak input validation in the ejs.renderFile function, which can lead to remote code execution. Recommendations For versions prior to 2.5.3, update to version 2.5.3 or later to...

PT-2017-10886

Name of the Vulnerable Software and Affected Versions ejs versions prior to 2.5.5 Description The issue is related to a denial-of-service caused by weak input validation in the ejs.renderFile function. Recommendations For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the...

PT-2017-10885

Name of the Vulnerable Software and Affected Versions ejs versions prior to 2.5.5 Description The issue is related to a Cross-site-scripting vulnerability in the ejs.renderFile function, which can result in code injection. Recommendations For versions prior to 2.5.5, update to version 2.5.5 or...

CVE-2017-1000189: Improper Input Validation

nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile...

nodejs ejs remote code execution vulnerability

nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A remote code execution vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.3, which stems from weak input validation. A remote attacker could...

CVE-2017-1000188: Improper Neutralization of Input During Web Page Generation

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...

CVE-2017-1000228: Improper Input Validation

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile function...

Cross-Site Scripting (XSS)

ejs is vulnerable to cross-site scripting XSS attacks. A malicious user can edit the localNames variable in the OPTS array which renders any arbitrary javascript in that variable...

Cross-site Scripting (XSS)

Overview ejs is a popular JavaScript templating engine. Affected versions of the package are vulnerable to Cross-site Scripting by letting the attacker under certain conditions control and override the filename option causing it to render the value as is, without escaping it. You can read more...

Denial of Service (DoS)

Overview ejs is a popular JavaScript templating engine. Affected versions of the package are vulnerable to Denial of Service by letting the attacker under certain conditions control and override the localNames option causing it to crash. You can read more about this vulnerability on the Snyk blog...

Remote Code Execution (RCE)

Overview ejs is a popular JavaScript templating engine. Affected versions of the package are vulnerable to Remote Code Execution by letting the attacker under certain conditions control the source folder from which the engine renders include files. You can read more about this vulnerability on th...