EUVD-2018-0812

Malware in sbrugna...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

GHSA-HJM9-576Q-399P Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

org.esigate:esigate-cas (3.1), org.esigate:esigate-jsf (3.1) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.1)

org.esigate:esigate-core MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.1 - org.esigate:esigate-jsf 3.1 - org.esigate:esigate-oscache 3.1 -...

org.esigate:esigate-cas (3.4.1), org.esigate:esigate-jsf (3.4.1) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.4.1)

org.esigate:esigate-core MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.4.1 - org.esigate:esigate-jsf 3.4.1 - org.esigate:esigate-taglib 3.4.1 -...

org.esigate:esigate-cas (4.0-beta-2), org.esigate:esigate-jsf (4.0-beta-2) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0-beta-2)

org.esigate:esigate-core MAVEN version 4.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0-beta-2 - org.esigate:esigate-jsf 4.0-beta-2 - org.esigate:esigate-taglib...

org.esigate:esigate-cas (4.2), org.esigate:esigate-distribution (4.2) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2)

org.esigate:esigate-core MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2 - org.esigate:esigate-distribution 4.2 - org.esigate:esigate-jsf 4.2 -...

org.esigate:esigate-cas (4.2.1), org.esigate:esigate-distribution (4.2.1) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2.1)

org.esigate:esigate-core MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2.1 - org.esigate:esigate-distribution 4.2.1 - org.esigate:esigate-jsf 4.2.1 -...

org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02), org.esigate:esigate-cas (4.3) +5 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.3)

org.esigate:esigate-core MAVEN version 4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.apache.olingo:odata-fit =4.0.0-beta-01-rc01, =4.0.0-beta-02 - org.esigate:esigate-cas 4.3 -...

org.esigate:esigate-cas (>=5.0-beta-1, <=5.2), org.esigate:esigate-distribution (>=5.0-beta-1, <=5.2) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=5.0-beta-1, <=5.2)

org.esigate:esigate-core MAVEN version =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.2 Source cves: CVE-2018-1000854 Source advisory: OSV:GHSA-HJM9-576Q-399P...

Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

Remote Code Execution (RCE)

esigate-core is vulnerable to remote code execution RCE. The ESIGate supports esi:include tag along with stylesheet attribute which would allow a remote attacker to execute code on the server with a user specified XSLT...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02) +8 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=3.1, <=5.2)

org.esigate:esigate-core MAVEN version =3.1, =4.0.0-beta-01-rc01, =3.1, =4.0, =3.1, =3.1, =5.0-beta-1, =3.1, =4.0-beta-2, =3.1, =4.4 Source cves: CVE-2018-1000854 Source advisory: MEND:CVE-2018-1000854...

CVE-2018-1000854

CVE-2018-1000854 concerns esigate.org esigate, affected up to version 5.2. The vulnerability arises from CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the ESI directive that uses user-specified XSLT, enabling remote code execution. T...

CVE-2018-1000854: Improper Neutralization of Special Elements in Output Used by a Downstream Component

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

PT-2018-9578

Name of the Vulnerable Software and Affected Versions esigate version 5.2 and earlier Description The issue concerns a problem with the neutralization of special elements in output used by a downstream component, which can lead to remote code execution. This is exploitable via the use of another...