CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

UBUNTU-CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

PYSEC-2021-52

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

Sql injection

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

CVE-2021-25283

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

SaltStack Salt Code Injection Vulnerability

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A code injection vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from a failure of t...

Saltstack SaltStack Salt 代码注入漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A code injection vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from a failure of t...

[ASA-202102-20] python2-jinja: denial of service

Arch Linux Security Advisory ASA-202102-20 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2020-28493 Package : python2-jinja Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1523 Summary ======= The package python2-jinja befo...

[ASA-202102-19] python-jinja: denial of service

Arch Linux Security Advisory ASA-202102-19 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2020-28493 Package : python-jinja Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1523 Summary ======= The package python-jinja before...

AZL-75813 CVE-2020-28493 affecting package nodejs24 for versions less than 24.13.0-1

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to...

EulerOS 2.0 SP5 : python-jinja2 (EulerOS-SA-2020-1127)

According to the version of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape.CVE-2019-10906 Note that Tenable Network Security has extracted the...

PYSEC-2020-204

Ansible before 1.6.7 does not prevent inventory data with "" and "lookup" substrings, and does not prevent remote data with "" substrings, which allows remote attackers to execute arbitrary code via 1 crafted lookup'pipe' calls or 2 crafted Jinja2 data...

CVE-2015-5215

The default configuration of the Jinja templating engine used in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via template variables. NOTE: This may be a duplica...

Cross site scripting

DISPUTED The default configuration of the Jinja templating engine used in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via template variables. NOTE: This may be ...

CVE-2015-5215

CVE-2015-5215 affects the Identity Provider (IdP) server of Ipsilon, specifically versions 0.1.0 through 1.0.0, where the Jinja templating engine is not auto-escaped by default. The documented consequence is easier remote cross-site scripting (XSS) via template variables, tied to the IdP’s defaul...

PT-2020-7856 · Ipsilon +1 · Ipsilon +1

Name of the Vulnerable Software and Affected Versions: Ipsilon versions 0.1.0 through 1.0.0 Description: The default configuration of the Jinja templating engine in the Identity Provider IdP server does not enable auto-escaping, making it easier for remote attackers to conduct cross-site scriptin...

CVE-2015-5215

The default configuration of the Jinja templating engine used in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via template variables. NOTE: This may be a duplica...

Huawei EulerOS: Security Advisory for python-jinja2 (EulerOS-SA-2019-1816)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python-jinja2: Sandbox escape due to information disclosure via str.format

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity a...