GHSA-HJM9-576Q-399P Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

org.esigate:esigate-cas (3.1), org.esigate:esigate-jsf (3.1) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.1)

org.esigate:esigate-core MAVEN version 3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.1 - org.esigate:esigate-jsf 3.1 - org.esigate:esigate-oscache 3.1 -...

org.esigate:esigate-cas (3.4.1), org.esigate:esigate-jsf (3.4.1) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (3.4.1)

org.esigate:esigate-core MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 3.4.1 - org.esigate:esigate-jsf 3.4.1 - org.esigate:esigate-taglib 3.4.1 -...

org.esigate:esigate-cas (4.0-beta-2), org.esigate:esigate-jsf (4.0-beta-2) +3 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.0-beta-2)

org.esigate:esigate-core MAVEN version 4.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.0-beta-2 - org.esigate:esigate-jsf 4.0-beta-2 - org.esigate:esigate-taglib...

org.esigate:esigate-cas (4.2), org.esigate:esigate-distribution (4.2) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2)

org.esigate:esigate-core MAVEN version 4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2 - org.esigate:esigate-distribution 4.2 - org.esigate:esigate-jsf 4.2 -...

org.esigate:esigate-cas (4.2.1), org.esigate:esigate-distribution (4.2.1) +4 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.2.1)

org.esigate:esigate-core MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.esigate:esigate-cas 4.2.1 - org.esigate:esigate-distribution 4.2.1 - org.esigate:esigate-jsf 4.2.1 -...

org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02), org.esigate:esigate-cas (4.3) +5 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (4.3)

org.esigate:esigate-core MAVEN version 4.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.esigate:esigate-core and may be impacted: - org.apache.olingo:odata-fit =4.0.0-beta-01-rc01, =4.0.0-beta-02 - org.esigate:esigate-cas 4.3 -...

org.esigate:esigate-cas (>=5.0-beta-1, <=5.2), org.esigate:esigate-distribution (>=5.0-beta-1, <=5.2) +2 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=5.0-beta-1, <=5.2)

org.esigate:esigate-core MAVEN version =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.0-beta-1, =5.2 Source cves: CVE-2018-1000854 Source advisory: OSV:GHSA-HJM9-576Q-399P...

Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

Remote Code Execution (RCE)

esigate-core is vulnerable to remote code execution RCE. The ESIGate supports esi:include tag along with stylesheet attribute which would allow a remote attacker to execute code on the server with a user specified XSLT...

de.cezaryrk.olingo:odata-fit (5.0.1-renamed), org.apache.olingo:odata-fit (>=4.0.0-beta-01-rc01, <=4.0.0-beta-02) +8 more potentially affected by CVE-2018-1000854 via org.esigate:esigate-core (>=3.1, <=5.2)

org.esigate:esigate-core MAVEN version =3.1, =4.0.0-beta-01-rc01, =3.1, =4.0, =3.1, =3.1, =5.0-beta-1, =3.1, =4.0-beta-2, =3.1, =4.4 Source cves: CVE-2018-1000854 Source advisory: MEND:CVE-2018-1000854...