CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

3599 matches found

VulnCheck KEV•added 2019/04/23 12:00 a.m.•11 views

VulnCheck KEV: CVE-2019-3396

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution...

10CVSS8.7AI score0.99913EPSS

SaveIn wildExploits22References990

OSV•added 2019/04/19 10:29 p.m.•15 views

CVE-2019-11354

The client in Electronic Arts EA Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices...

7.8CVSS7.6AI score0.23129EPSS

SaveExploits8References12

Prion•added 2019/04/19 10:29 p.m.•43 views

Remote code execution

6.8CVSS8.3AI score0.23129EPSS

SaveExploits8References12Affected Software1

NVD•added 2019/04/19 10:29 p.m.•55 views

CVE-2019-11354

7.8CVSS8.1AI score0.23129EPSS

SaveExploits8References12

CVE•added 2019/04/19 9:29 p.m.•154 views

CVE-2019-11354

The CVE-2019-11354 entry concerns the EA Origin Windows client (Origin 10.5.36 and potentially earlier) and a template-injection flaw in the Origin2 URI handler title parameter that can escape the AngularJS sandbox, enabling remote code execution via an origin2://game/launch URL used by QtApplica...

7.8CVSS8.2AI score0.23129EPSS

SaveExploits8References12Affected Software1

Cvelist•added 2019/04/19 9:29 p.m.•61 views

CVE-2019-11354

8.4AI score0.23129EPSS

SaveExploits8References12

Rapid7 Vulnerability Database (full)•added 2019/04/19 12:00 a.m.•6 views

CVE-2019-11354: Improper Neutralization of Special Elements in Output Used by a Downstream Component

7.8CVSS6.3AI score0.23129EPSS

SaveExploits8References2

Positive Technologies•added 2019/04/19 12:00 a.m.•4 views

PT-2019-12254

Name of the Vulnerable Software and Affected Versions EA Origin version 10.5.36 Description The issue concerns template injection in the title parameter of the Origin2 URI handler, allowing an attacker to escape the AngularJS sandbox. This can lead to remote code execution via an...

7.8CVSS0.23129EPSS

SaveExploits8References17

Exploit DB•added 2019/04/19 12:00 a.m.•75 views

Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Atlassian Confluence Widget Connector Macro Velocity Template Injection", 'Description' = %q Widget Connector Macro is part of Atlassian Confluen...

10CVSS8.3AI score0.99913EPSS

SaveExploits22

Packet Storm•added 2019/04/18 12:00 a.m.•453 views

Atlassian Confluence Widget Connector Macro Velocity Template Injection

10CVSS8.3AI score0.99913EPSS

SaveExploits22

zdt•added 2019/04/18 12:00 a.m.•792 views

Atlassian Confluence Widget Connector Macro Velocity Template Injection Exploit

Widget Connector Macro is part of Atlassian Confluence Server and Data Center that allows embed online videos, slideshows, photostreams and more directly into page. A template parameter can be used to inject remote Java code into a Velocity template, and gain code execution. Authentication is not...

10CVSS8.7AI score0.99913EPSS

SaveExploits22

Tenable Nessus•added 2019/04/11 12:00 a.m.•83 views

Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection

According to the tests performed by Nessus, the remote host is affected by the following vulnerability: - A server-side template injection exists in the Widget Connector due to improper input validation. An attacker can exploit this, via unspecified vectors, to traverse directories or execute...

10CVSS8.7AI score0.99913EPSS

SaveExploits22References2

OSV•added 2019/03/25 7:29 p.m.•12 views

CVE-2019-3396

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 the fixed version for 6.6.x, from version 6.7.0 before 6.12.3 the fixed version for 6.12.x, from version 6.13.0 before 6.13.3 the fixed version for 6.13.x, and from version 6.14.0 before 6.14.2 the fixed version for...

9.8CVSS8.8AI score0.99913EPSS

SaveExploits22References6

NVD•added 2019/03/25 7:29 p.m.•32 views

CVE-2019-3396

10CVSS10AI score0.99913EPSS

SaveExploits22References6

Prion•added 2019/03/25 7:29 p.m.•52 views

Path traversal

10CVSS9.8AI score0.99913EPSS

SaveExploits22References5Affected Software2

Vulnrichment•added 2019/03/25 6:37 p.m.•30 views

CVE-2019-3396

8.8AI score0.99913EPSS

SaveExploits22References5

CVE•added 2019/03/25 6:37 p.m.•2207 views

CVE-2019-3396

CVE-2019-3396 – Atlassian Confluence Widget Connector SSTI RCE : A server-side template injection flaw in the Widget Connector macro allows remote attackers to perform path traversal and achieve remote code execution on Confluence Server/Data Center. Fixes are in Confluence versions: 6.6.12 (6.6....

10CVSS8.8AI score0.99913EPSS

SaveIn wildExploits22References6Affected Software1

Cvelist•added 2019/03/25 6:37 p.m.•44 views

CVE-2019-3396

9.9AI score0.99913EPSS

SaveExploits22References5

attackerkb•added 2019/03/25 12:00 a.m.•61 views

CVE-2019-3396

10CVSS8.8AI score0.99913EPSS

SaveIn wildExploits22References7

Rapid7 Vulnerability Database (full)•added 2019/03/25 12:00 a.m.•7 views

CVE-2019-3396: Improper Limitation of a Pathname to a Restricted Directory

10CVSS8.8AI score0.99913EPSS

SaveExploits22References2

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by