2955 matches found
CVE-2024-41667 OpenAM FreeMarker template injection
OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...
PT-2024-5297 · Openiam · Openam
Name of the Vulnerable Software and Affected Versions: OpenAM versions 15.0.3 and prior Description: The issue is related to the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java, which is vulnerable to template injection due to its usage of user input. This vulnerability allow...
OpenAM 安全漏洞
OpenAM is an all-in-one access management solution organized by the OpenAM Consortium. It provides authentication, authorization, delegation and federation capabilities. A security vulnerability exists in OpenAM version 15.0.3 and earlier versions, which stems from vulnerability to template...
VulnCheck KEV: CVE-2024-4879
ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely...
Server-Side Template Injection (SSTI)
opencart/opencart is vulnerable to Server-Side Template Injection SSTI.The vulnerability is due to the edit theme function allowing attackers with admin access to execute arbitrary code via template payloads...
Exploit for CVE-2024-42587
LLMVulnSphere All Security Issues about LLM Software Componen...
Template Injection
Apache StreamPark is vulnerable to template injection. The vulnerability is due to insufficient input validation that allows attacker to perform a template injection that potentially leads to execution of arbitrary code on server...
Vulnerabilities fixed in Cisco Secure Email Gateway
Two vulnerabilities have been fixed in Cisco Secure Email Gateway. The most serious vulnerability concerns CVE-2024-20401 and allows an unauthenticated malicious person, through sending a mail with specially prepared attachment: Add users with root privileges Modify the configuration of the devic...
Apache StreamPark: FreeMarker SSTI RCE Vulnerability
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...
CVE-2024-29178
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...
CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability. Mitigation: all users should upgrade to 2.1.4...
CVE-2024-29178
Apache StreamPark before version 2.1.4 is affected by a FreeMarker SSTI vulnerability that an authenticated user can exploit to achieve Remote Code Execution on the server. Root cause: template injection via FreeMarker in the application, with high impact (CVE-2024-29178). Remediation: upgrade to...
Template Injection
github.com/requarks/wiki is vulnerable to Template injection. The vulnerability is due to improper sanitization of user inputs, allowing attackers to inject malicious JavaScript into the content section of pages. Attackers can exploit this by inserting an invalid HTML tag with a template injectio...
PT-2024-22784
Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 2.1.4 Description The issue allows a user to perform a template injection attack, resulting in Remote Code Execution on the server. This can be done after a successful login, making it a moderate-impact issue...
Apache StreamPark 代码注入漏洞
Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. A code injection vulnerability exists in Apache StreamPark versions prior to 2.1.4, which stems from a user being able to log in and perform a template injection attack. No...
ServiceNow Server-Side Template Injection
ServiceNow is affected by a vulnerability allowing an unauthenticated attacker to obtain Server-Side Template Injection via a specially forged request. This vulnerability can be used to execute arbitrary code. No source data...
openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
GHSA-XRH7-2GFQ-4RCQ openCart Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection SSTI vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload...
PT-2024-27131
Name of the Vulnerable Software and Affected Versions OpenCart version 4.0.2.3 Description The issue is related to a Server-Side Template Injection SSTI vulnerability via the Theme Editor Function. This allows attackers to execute arbitrary code by injecting a crafted payload. Recommendations For...
