PT-2022-27071 · Unknown · Stackstorm

Name of the Vulnerable Software and Affected Versions: StackStorm version 3.7.0 Description: The issue is related to improper access control in Key-Value RBAC, where permissions in Jinja filters are not checked, allowing attackers to access Key-Value pairs of other users. This could potentially...

CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information...

DEBIAN-CVE-2022-45132

In Linaro Automated Validation Architecture LAVA before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger...

LAVA 代码注入漏洞

LAVA is a continuous integration system from LAVA open source. It is used to deploy operating systems to physical and virtual hardware to run tests. A security vulnerability exists in versions of LAVA prior to 2022.11.1 that stems from its REST API endpoint for validating device profiles loading...

GHSA-MXVC-FWGX-J778 Whoogle Search Cross-site Scripting via string parameter

The package whoogle-search before version 0.7.2 is vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate...

CVE-2022-25303

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate functio...

CVE-2022-25303 Cross-site Scripting (XSS)

The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate functio...

CVE-2022-25303

The CVE-2022-25303 issue affects the Whoogle Search project (before v0.7.2). The vulnerability is a Cross-site Scripting (XSS) flaw in the query parameter q: when the value does not contain http, it is used to build error_message, which is then rendered via Flask's render_template with the Jinja2...

GHSA-XGMH-GFXW-2HVV SaltStack Salt Server Side Template Injection

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks...

Ansible Arbitrary Code Execution

User module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. If the content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function...

GHSA-4CVM-5776-JX9F Ansible Arbitrary Code Execution

User module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. If the content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function...

GLSA-202107-19 : Jinja: Denial of service

The remote host is affected by the vulnerability described in GLSA-202107-19 Jinja: Denial of service The urlize filter in Jinja utilized an inefficient regular expression that could be exploited to consume excess CPU. Impact : An attacker could cause a Denial of Service condition via crafted inp...

jinja-trip.com Cross Site Scripting vulnerability OBB-2321389

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...

CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...

Default credentials

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...

CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...

CVE-2021-44657

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...

CVE-2021-44657

CVE-2021-44657 affects StackStorm versions before 3.6.0, where the Jinja interpreter was not run in sandbox mode, enabling unsafe system command execution. The issue stems from Jinja not enabling sandboxed mode by default for backwards compatibility; StackStorm now forces sandboxed Jinja by defau...

CVE-2021-44657: Undefined Security Weakness

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default...