14778 matches found
CVE-2025-54287
Template Injection in instance snapshot creation component in Canonical LXD = 4.0 allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine...
CVE-2025-54287
Template Injection in instance snapshot creation component in Canonical LXD = 4.0 allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine...
CVE-2025-54287 Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD = 4.0 allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine...
CVE-2025-54287 Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD = 4.0 allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine...
CVE-2025-54287 Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD = 4.0 allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 template engine...
Cross-site Scripting (XSS)
Overview behavex is an Agile testing framework on top of Behave BDD. Affected versions of this package are vulnerable to Cross-site Scripting XSS via when rendering step.text in the HTML report template. An attacker can inject arbitrary HTML or JavaScript in the context of a user's browser by...
LXD 安全漏洞
LXD is a Canonical open source container for managing applications on Linux-based systems. A security vulnerability exists in LXD 4.0 and later versions, which stems from a template injection when the instance snapshot creation component uses the Pongo2 template engine, which could result in...
PT-2025-40327
Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0 and later Description A template injection issue exists in the instance snapshot creation component. An attacker with instance configuration permissions can read arbitrary files on the host system by using specially...
VulnCheck KEV: CVE-2023-27008
A Cross-site scripting XSS vulnerability in the function encryptpassword in login.tmpl.php in ATutor 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Django vulnerabilities (USN-7794-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7794-1 advisory. It was discovered that Django incorrectly handled special characters in the QuerySet...
Relative Path Traversal
Overview Affected versions of this package are vulnerable to Relative Path Traversal via the django.utils.archive.extract function used by startapp --template and startproject --template. An attacker can modify files outside the intended extraction directory by crafting an archive with file paths...
GHSA-Q95W-C7QG-HRFF Django vulnerable to partial directory traversal via archives
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common...
CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common...
CVE-2025-27223
creationtimestamp| type| source ---|---|--- 2025-10-01 18:49:45+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-27223.yaml 2025-10-02 21:02:26+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m2ahapki2u26 2025-10-18...
USN-7794-1 python-django vulnerabilities
It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A remote attacker could possibly use this issue to perform SQL injection attacks. CVE-2025-59681 It was discovered that Django incorrectly handled files with the same path prefix when starting wit...
USN-7794-1: Django vulnerabilities
It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A remote attacker could possibly use this issue to perform SQL injection attacks. CVE-2025-59681 It was discovered that Django incorrectly handled files with the same path prefix when starting wit...
CLSA-2025-1759335207 gnutls: Fix of CVE-2025-32990
CVE-2025-32990: fix heap-buffer-overflow issue in template parsing logic within certtool utility...
CLSA-2025-1759334959 gnutls: Fix of CVE-2025-32990
CVE-2025-32990: fix heap-buffer-overflow flaw in template parsing logic to prevent OOB NULL pointer write and memory corruption...
CLSA-2025-1759334361 gnutls: Fix of CVE-2025-32990
CVE-2025-32990: fix heap-buffer-overflow flaw in template parsing logic to prevent OOB NULL pointer write and memory corruption...
UBUNTU-CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common...