CVE-2024-55085

CVE-2024-55085 affects GetSimple CMS CE 3.3.19. The issue is an arbitrary code execution in the template editing function of the backend management system, enabling remote code execution (RCE). Documented CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector and no user interaction requir...

PT-2024-36714 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: The issue allows authenticated users to inject payloads while querying the Search Template Dashboard. These payloads are executed, leading to Server-Side Template Injection. Recommendations: For...

CVE-2024-56085

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection...

CVE-2024-56087

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading to Server-Side Template Injection...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.5.0, which stems from the fact that an authenticated user can inject payloads during the creation of a search template dashboard, which can be executed,...

CVE-2024-56085

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading to Server-Side Template Injection...

CVE-2024-56087

An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading to Server-Side Template Injection...

CVE-2024-56087

CVE-2024-56087 affects Logpoint prior to 7.5.0. Authenticated users can inject payloads through queries in the Search Template Dashboard, which are then executed and cause Server-Side Template Injection. Affected software: Logpoint before 7.5.0. Root cause: injectable payloads in SSTI-prone dashb...

CVE-2024-55085

GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE...

CVE-2024-56085

Vulnerability overview (CVE-2024-56085) : Logpoint versions before 7.5.0 expose a Server-Side Template Injection (SSTI) in the process of creating a Search Template Dashboard . Authenticated users can inject payloads that are executed on the server side, indicating a flaw in the template renderin...

FastNetMon 安全漏洞

FastNetMon is a high-performance DDoS detector/sensor built on multiple packet capture engines by the individual developer Pavel Odintsov. A security vulnerability exists in FastNetMon 1.2.7 and earlier versions, which stems from the presence of a zero-length template for Netflow v9, which allows...

OESA-2024-2551 etcd security update

%expand: Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the...

OESA-2024-2552 etcd security update

%expand: Security Fixes: Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the...

USN-7158-1: Smarty vulnerabilities

It was discovered that Smarty incorrectly handled query parameters in requests. An attacker could possibly use this issue to inject arbitrary Javascript code, resulting in denial of service or potential execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubun...

USN-7158-1 smarty3 vulnerabilities

It was discovered that Smarty incorrectly handled query parameters in requests. An attacker could possibly use this issue to inject arbitrary Javascript code, resulting in denial of service or potential execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubun...

UBUNTU-CVE-2024-9367

An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service DoS condition while parsing templates to generate...

CVE-2024-9367 Allocation of Resources Without Limits or Throttling in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service DoS condition while parsing templates to generate...

CVE-2024-55601

A flaw was found in the Hugo static site generator. Some HTML attributes in Markdown in the internal templates do not escape in internal render hooks. Hugo users who do not trust their Markdown content files and are using one or more of these templates are impacted; default/markup/render-link.htm...

CVE-2024-55660

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection SSTI through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables...

Image Access Scan2Net 安全漏洞

Image Access Scan2Net is a scanning software from Image Access Germany. A security vulnerability exists in Image Access Scan2Net versions 7.40 and earlier, 7.42 and earlier, and 7.42B and earlier, which originates from an authenticated attacker who can perform SQL injection by accessing the...