127 matches found
CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
Design/Logic Flaw
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
CVE-2022-29078
CVE-2022-29078 affects Node.js ejs, version 3.1.6. The vulnerability is a server-side template injection in settings[view options][outputFunctionName], where input is parsed as an internal option and can overwrite outputFunctionName to execute an arbitrary OS command during template compilation. ...
CVE-2022-29078
The ejs aka Embedded JavaScript templates package 3.1.6 for Node.js allows server-side template injection in settingsview optionsoutputFunctionName. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command which is executed upon template...
Github ejs 代码注入漏洞
Github ejs is an embedded JavaScript template. A code injection vulnerability exists in ejs version 3.1.6, which stems from server-side template injection being possible in settingsview optionsoutputFunctionName. This is parsed as an internal option and the outputFunctionName option is overridden...
PT-2022-3563
Name of the Vulnerable Software and Affected Versions ejs versions 3.1.6 Description The issue is related to the ejs package for Node.js, which allows server-side template injection in settingsview optionsoutputFunctionName. This can be parsed as an internal option and overwrites the...
192.168.0.172 (=4.6.1), 2d-json-schema-editor-visual (>=1.0.2 <=1.0.7) +2088 more potentially affected by CVE-2017-1000189 via ejs (>=0.0.1 <=2.5.4)
ejs NPM version =0.0.1, =1.0.2, =0.0.1, =2.0.0-rc5, =0.1.0, =2.1.2, =0.1.0, =0.25.0, =0.4.5, =0.12.0-edge9, =2.1.5, =2.6.0 - @colmena/api =0.1.0 and more Source cves: CVE-2017-1000189 Source advisory: OSV:GHSA-6X77-RPQF-J6MW...
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile...
GHSA-6X77-RPQF-J6MW ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile...
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile function...
GHSA-3W5V-P54C-F74X ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile function...
GHSA-HWCF-PP87-7X6P mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...
192.168.0.172 (=4.6.1), 2d-json-schema-editor-visual (>=1.0.2 <=1.0.7) +2088 more potentially affected by CVE-2017-1000188 via ejs (>=0.0.1 <=2.5.4)
ejs NPM version =0.0.1, =1.0.2, =0.0.1, =2.0.0-rc5, =0.1.0, =2.1.2, =0.1.0, =0.25.0, =0.4.5, =0.12.0-edge9, =2.1.5, =2.6.0 - @colmena/api =0.1.0 and more Source cves: CVE-2017-1000188 Source advisory: OSV:GHSA-HWCF-PP87-7X6P...
CVE-2017-1000189
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile...
CVE-2017-1000188
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...
Denial Of Service (DoS)
ejs is vulnerable to denial of service DoS attacks. The library does not sanitize the opts parameter in the ejs.renderFile function, allowing a malicious user to pass files that when rendered can crash the application...
Cross-site Scripting (XSS)
ejs is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the opts parameter in the cpOptsInData function, allowing a malicious user to pass files that can get executed when rendered...