2772 matches found
VMware 多款产品代码注入漏洞
Vmware Workspace One Access is a U.S.-based Vmware company that combines user identity with device and network information, among other factors, to make intelligent, conditional access decisions for Workspace One-delivered applications. vmware Workspace ONE Access and Identity Manager has a remot...
VulnCheck KEV: CVE-2022-22954
VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection...
VMware Workspace ONE Access CVE-2022-22954
This module exploits CVE-2022-22954, an unauthenticated server-side template injection SSTI in VMware Workspace ONE Access, to execute shell commands as the "horizon" user. Module Options msf use exploit/linux/http/vmware/workspaceoneaccesscve202222954 msf undefinedworkspaceoneaccesscve202222954...
Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
This blog post was authored by Ankur Saini, with contributions from Hossein Jazi and Jérôme Segura 2022-04-07: Added MITRE ATT&CK mappings 2022-04-07: Changed the name of the final payload from Vidar to Mars Stealer Colibri Loader is a relatively new piece of malware that first appeared on...
VMSA-2022-0011:VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities
Advisory ID:VMSA-2022-0011.2 CVSSv3 Range:5.3-9.8 Issue Date:2022-04-06 Updated On:2022-04-13 CVEs:CVE-2022-22954, CVE-2022-22955,CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960, CVE-2022-22961 Synopsis:VMware Workspace ONE Access, Identity Manager and vRealize...
CVE-2021-43097
A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...
CVE-2021-43097
A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...
Sql injection
A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...
CVE-2021-43097
The provided connected documents indicate CVE-2021-43097 affects the bbs 5.3 web application, specifically a Server-side Template Injection (SSTI) in TemplateManageAction.java that could allow a malicious user to execute arbitrary code. This establishes the component/file and the underlying vulne...
CVE-2021-43097
A Server-side Template Injection SSTI vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code...
diyhi bbs 代码注入漏洞
diyhi bbs patrol cloud light forum system is a Chinese open source project , using JAVA + MYSQL architecture , adaptive mobile and computer , simple interface , high performance . diyhi bbs 5.3 version of the code injection vulnerability , the vulnerability stems from TemplateManageAction.javawhi...
CVE-2021-26622
An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability...
PT-2022-9771 · Genians · Genian Nac
Name of the Vulnerable Software and Affected Versions: Genian NAC affected versions not specified Description: A remote code execution issue was discovered due to a Server-Side Template Injection SSTI vulnerability and insufficient validation of the file name parameter. This allows remote attacke...
cron-utils: template Injection leading to unauthenticated Remote Code Execution
A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution RCE via Java Expression Language EL injection...
Template Injection in Email Templates - bypass of mitigation via XStream - CVE-2022-36799
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Templat...
CVE-2022-0944
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...
CVE-2022-0944
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...
Sql injection
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...
CVE-2022-0944 Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1...