CVE-2024-25151

CVE-2024-25151 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 before SP3, 7.2 before FP15, and older versions. The Calendar module does not escape user-supplied data in the default notification email template, enabling remote authenticated users to inject script/HTML via the calendar even...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions due to the default assignment of view permissions to guest users for web content templates via the UI or API. Remediation Upgrade com.liferay:com.liferay.template.web to version 1.0.10 or higher. References...

Custom Field Template < 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label

Description The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $searchlabel parameter in versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Remote Code Execution (RCE)

redaxo/source is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of user-supplied input within the 'Template' functionality with in modules.modules.php, which allows attackers to execute arbitrary code...

App Layering - Set Static MAC Address on a Packaging Machine

By default an App layering packaging machine will use DHCP to assign an IP address. There is no built in mechanism to change this behavior to use a statically assigned IP. To work around this, a manually assigned MAC address can be set on a VM Template in your hypervisor. Then an IP address can b...

CVE-2024-25300

A cross-site scripting XSS vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section...

WordPress Custom Field Template Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25919 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9a3d14013fc0 Credits LVT-tholv2k Required privilege...

F5 BIG-IP Security Vulnerabilities

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other features. A security vulnerability exists in the F5 BIG-IP that originates when operating in appliance mode, where an authenticated...

PT-2024-20870 · Redaxo · Redaxo

Name of the Vulnerable Software and Affected Versions: Redaxo version 5.15.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section. Recommendations: For Redaxo version...

CVE-2024-25300

CVE-2024-25300 affects Redaxo v5.15.1, exposing an XSS in the Template section via the Name parameter. The root cause is unsanitized input in Name, allowing arbitrary web scripts/HTML execution. Impact is limited to the affected user/recipient interactions as described (no exploit details provide...

Redaxo Cross-Site Scripting Vulnerability

Redaxo is a content management system from Redaxo open source. A cross-site scripting vulnerability exists in Redaxo version v5.15.1 that originates from a payload that allows an attacker to execute arbitrary web script or HTML via a payload injected into the Name parameter of the Template sectio...

CVE-2024-25300

A cross-site scripting XSS vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Sql injection

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Arbitrary File Write

github.com/hashicorp/nomad is vulnerable to Arbitrary File Write. The vulnerability is due to improper handling of symlinks by the template renderer. The attacker can manipulate file paths and write arbitrary files to the host system...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

CVE-2024-23761

CVE-2024-23761 affects Gambio, specifically version 4.9.2.0 (and prior per CNNVD/CNNVD-like sources), where a Server Side Template Injection via a crafted smarty email template allows an attacker to execute arbitrary code. The issue is described consistently across Red Hat, NVD, CVE listings, and...

CVE-2024-23761

Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template...

Gambio Code Issue Vulnerability

Gambio is an all-in-one e-commerce solution from Gambio, Inc. A code issue vulnerability exists in Gambio 4.9.2.0 and prior versions that stems from allowing an attacker to run arbitrary code via a crafted smarty email template...