1046 matches found
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
GHSA-35JP-8CGG-P4WJ Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
Server-Side Template Injection (SSTI)
opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...
GHSA-XRH7-2GFQ-4RCQ openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
PT-2024-27131
Name of the Vulnerable Software and Affected Versions OpenCart version 4.0.2.3 Description The issue is related to a Server-Side Template Injection SSTI vulnerability via the Theme Editor Function. This allows attackers to execute arbitrary code by injecting a crafted payload. Recommendations For...
PT-2024-28841 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: opencart version 4.0.2.3 Description: A Server-Side Template Injection SSTI vulnerability in the edit theme function allows attackers to execute arbitrary code via injecting a crafted payload. Recommendations: For version 4.0.2.3, at the...
CVE-2024-40420
CVE-2024-40420 is rejected/not used and does not represent an active vulnerability entry.
PT-2024-4769 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.4.0 through 2.9.3 Description: This vulnerability allows authenticated DAG authors to craft a malicious doc md parameter, potentially leading to arbitrary code execution within the scheduler context. This bypasses...
Server-Side Template Injection
airbyte is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of user input in the connection builder, allowing attackers to execute arbitrary code on the server...
Exploit for Code Injection in Rejetto Http_File_Server
An unauth SSTI in the Rejetto HTTP File Server HFS. Original...
CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...
CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...
CVE-2024-37621
StrongShop v1.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the component /shippingOptionConfig/index.blade.php...
PT-2024-27678 · Unknown · Strongshop
Name of the Vulnerable Software and Affected Versions: StrongShop version 1.0 Description: A Server-Side Template Injection SSTI issue was found in the /shippingOptionConfig/index.blade.php component. Recommendations: For StrongShop version 1.0, consider restricting access to the vulnerable...