68 matches found
Unsafe Function Usage
jinjava does not disallow the use of unsafe functions and is potentially vulnerable to remote code execution. The getClass method is not blocked in com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java, which could potentially allow an attacker to execute arbitrary Java or OS commands using...
Unspecified vulnerability in Jinjava
Jinjava is a Java-based Jinja template engine . A security vulnerability exists in Jinjava versions prior to 2.4.6. No details of the vulnerability are provided at this time...
Design/Logic Flaw
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...
CVE-2018-18893
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...
CVE-2018-18893
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...
CVE-2018-18893
Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java...
CVE-2018-18893
CVE-2018-18893 affects Jinjava up to version 2.4.5; the vulnerability arises because JinjavaBeanELResolver does not block getClass, enabling potential attacker-controlled object types to influence evaluation. Public references (GHSA, OSV, Veracode) describe risks of remote code execution or arbit...
