CVE-2024-22195

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...

CVE-2024-22195 Jinja vulnerable to Cross-Site Scripting (XSS)

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...

PT-2024-15549 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS versions up to 2020-06-23 Description: A critical issue has been found in ForU CMS, affecting the processing of the file admin/cms template.php. The manipulation of the argument t name/t path leads to sql injection. The attack may be...

PT-2024-19268 · Unknown · Django Template Engine

Name of the Vulnerable Software and Affected Versions: Django template engine for Fiber versions prior to the latest patched version Description: This issue specifically impacts web applications that render user-supplied data through the Django template engine, potentially leading to the executio...

ForU CMS SQL Injection Vulnerability

ForU CMS is a website builder system of ForU open source. ForU CMS 2020-06-23 and earlier versions exist SQL injection vulnerability , the vulnerability stems from the file admin/cmstemplate.php SQL injection vulnerability...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber template versions prior to 3.1.9, which stems from the presence of a cross-site scripting XSS vulnerability. The vulnerability can be exploited by an attacker to execute malicious script in ...

PT-2024-15181 · WordPress · The Lightstart – Maintenance Mode

Name of the Vulnerable Software and Affected Versions: The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress versions up to, and including, 2.6.8 Description: The issue is related to a missing capability check on the insert template function, allowing...

Jinja Cross-Site Scripting Vulnerability

Pallets Jinja is a template engine written in the Python language. A security vulnerability exists in Jinja versions prior to 3.1.3, which stems from a cross-site scripting XSS vulnerability...

golang: html/template: improper handling of special tags within script contexts

A flaw was found in Golang. The html/template package did not apply the proper rules for handling occurrences of " contexts. This issue may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped...

Moderate: Red Hat Security Advisory: container-tools:4.0 security update

An update for the container-tools:4.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

golang: html/template: improper handling of HTML-like comments within script contexts

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...

Django -- multiple vulnerabilities

Django reports: CVE-2024-24680:Potential denial-of-service in intcomma template filter...

GHSA-MQPQ-2P68-46FV pyload Unauthenticated Flask Configuration Leakage vulnerability

Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. PoC Run pyload in the default configuration by...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

Design/Logic Flaw

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

Medium: ansible-core

Issue Overview: The upstream bug report describes this issue as follows: A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove the unsafe designation from template data. CVE-2023-5764 Affected Packages:...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-465)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-465 advisory. The upstream bug report describes this issue as follows:A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove...

Medium: ansible-core

Issue Overview: The upstream bug report describes this issue as follows: A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove the unsafe designation from template data. CVE-2023-5764 Affected Packages:...