Astra Linux - уязвимость в python-django

Django versions prior to 2.2.24, 3.x prior to 3.1.12, and 3.2.x prior to 3.2.4 have a potential issue with directory traversal through django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default...

jinja2: Jinja has a sandbox breakout through malicious filenames

A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents o...

CVE-2022-3501

Article template contents with sensitive data could be accessed from agents without permissions...

CVE-2022-3501

Article template contents with sensitive data could be accessed from agents without permissions...

CVE-2021-46703

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment if users can externally control template contents. NOTE: This vulnerability only affects products that are no longer supported by the maintain...

CVE-2021-46703

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment if users can externally control template contents. NOTE: This vulnerability only affects products that are no longer supported by the maintain...

Remote Code Execution

velocity-engine-core is vulnerable to remote code execution. The Uberspector fails to prevent access to java.lang.ClassLoader methods and allows an attacker that is able to modify Template contents to execute arbitrary Java code or run arbitrary system commands with the same privileges as the...

Pligg <= 9.9.0 Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl -w use LWP::UserAgent; use MIME::Base64; use Digest::MD5 qwmd5hex; use Getopt::Std; getopts'h:', %args; print "\n"; print " Pligg = 9.9 Remote Code Execution Exploit \n"; print "\n"; dork = "Powered By Pligg" + "Legal: License and Source" Proxy...

CVE-2007-3816

JWIG might allow context-dependent attackers to cause a denial of service service degradation via loops of references to external templates. NOTE: this issue has been disputed by multiple third parties who state that only the application developer can trigger the issue, so no privilege boundaries...