PT-2023-16878 · Unknown · Insightcloudsec

Name of the Vulnerable Software and Affected Versions: InsightCloudSec versions prior to 23.2.1 Description: An authenticated attacker can leverage an exposed resource.db accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved...

InsightCloudSec 代码注入漏洞

InsightCloudSec is a fully integrated cloud-native security platform from InsightCloudSec. A security vulnerability exists in versions of InsightCloudSec prior to 23.3.21 that stems from an attacker being able to execute OS commands via a Jinja template utilizing the publicly available getattr...

PT-2023-16876 · Unknown · Insightcloudsec

Name of the Vulnerable Software and Affected Versions: InsightCloudSec versions prior to 23.2.1 Description: An authenticated attacker can leverage an exposed getattr method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. Thi...

InsightCloudSec 代码注入漏洞

InsightCloudSec is a fully integrated cloud-native security platform from InsightCloudSec. A security vulnerability exists in versions of InsightCloudSec prior to 23.3.21 that stems from an attacker being able to utilize the publicly available resource.db accessor method to invoke Python methods...

PYSEC-2023-37

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions earlier than 1.5.7 are impacted by a remote code execution vulnerability. Nautobot did not properly sandbox Jinja2 template rendering. In Nautobot 1.5.7 has enabled sandboxed environments for the...

SUSE CVE-2014-4966

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

SUSE CVE-2016-10745

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...

SUSE CVE-2019-10906

In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape...

SUSE CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

PT-2024-10415

Name of the Vulnerable Software and Affected Versions Jinja versions prior to 3.1.4 Description The issue is related to the xmlattr filter in Jinja, which accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as...

PT-2023-9827

Name of the Vulnerable Software and Affected Versions Jinja versions prior to 3.1.5 Description Jinja is an extensible templating engine. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if...

CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

Improper access control

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

StackStorm 安全漏洞

StackStorm is an event-driven automation platform. The platform is used for automated remediation, security response, troubleshooting and program deployment functions. A security vulnerability exists in StackStorm version 3.7.0, which stems from improper Key-Value RBAC access control that fails t...

CVE-2022-44009

StackStorm 3.7.0 is affected by an improper access control flaw in Key-Value RBAC, where permissions checks are not applied in Jinja filters. This could allow an attacker to access another user’s K/V pairs and potentially expose sensitive information. The provided documents consistently describe ...

PT-2022-27071 · Unknown · Stackstorm

Name of the Vulnerable Software and Affected Versions: StackStorm version 3.7.0 Description: The issue is related to improper access control in Key-Value RBAC, where permissions in Jinja filters are not checked, allowing attackers to access Key-Value pairs of other users. This could potentially...

CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

DEBIAN-CVE-2022-45132

In Linaro Automated Validation Architecture LAVA before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger...

LAVA 代码注入漏洞

LAVA is a continuous integration system from LAVA open source. It is used to deploy operating systems to physical and virtual hardware to run tests. A security vulnerability exists in versions of LAVA prior to 2022.11.1 that stems from its REST API endpoint for validating device profiles loading...