1378 matches found
CVE-2019-18582: Improper Control of Generation of Code
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
Server-Side Template Injection (SSTI)
nystudio107/craft-seomatic is vulnerable to server-side template injection. Lack of validation and sanitization allows an attacker to inject and execute arbitrary template variables that can lead to code execution via malicious data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
Sql injection
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757
Craft CMS SEOmatic component before 3.3.0 is vulnerable to Server-Side Template Injection that can lead to remote code execution via malformed data submitted to the metacontainers controller. The CVE-2020-9757 entry is corroborated by multiple connected documents (Nuclei template, Red Hat advisor...
CVE-2020-9757
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability class/vector is not explicitly stated, but the collection includes various environments with different vulnerabilities, such as SQL injection, cross-site scripting XSS, and server-side template...
PT-2020-6653 · Unknown · Dropwizard-Validation
Name of the Vulnerable Software and Affected Versions: Dropwizard-Validation versions prior to 1.3.19 Dropwizard-Validation versions prior to 2.0.2 Description: The issue allows arbitrary code execution on the host system with the privileges of the Dropwizard service account by injecting arbitrar...
SRC-2021-0002 : CSCart templates.manage Server Side Template Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CSCart. Authentication is required to exploit this vulnerability with the Files privilege. The specific flaw exists within the templates.manage dispatch method. The issue resul...
vulhub
It is an open-source collection of pre-built vulnerable docker environments. The primary vulnerability is a Flask SSTI Server-Side Template Injection vulnerability. The target product/service is Flask, a Python web framework. The vulnerability class/vector is SSTI, which allows an attacker to...
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
Design/Logic Flaw
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
CVE-2019-19999
Halo prior to 1.2.0-beta.1 is vulnerable to Server Side Template Injection (SSTI) because FreeMarker configuration does not use TemplateClassResolver.SAFER_RESOLVER. The issue affects Halo’s template handling and can allow injection via SSTI in untrusted template processing. Affected: Halo versio...
CVE-2019-19999
Halo before 1.2.0-beta.1 allows Server Side Template Injection SSTI because TemplateClassResolver.SAFERRESOLVER is not used in the FreeMarker configuration...
Atlassian Jira 7.0.10 < 7.6.16 Template Injection Vulnerability
According to its self-reported version number, the Atlassian Jira application running on the remote host is 7.0.10 7.6.16, 7.7.x 7.13.8, 8.1.x 8.1.3, 8.2.x 8.2.5, 8.3.x 8.3.4, 8.4.x 8.4.1. It is, therefore, affected by a server-side template injection vulnerability that exists in the Jira Importe...