PT-2023-6069 · Microsoft · Windows Runtime C++ Template Library +1

Name of the Vulnerable Software and Affected Versions: Windows Runtime C++ Template Library affected versions not specified Description: The issue is related to insufficient access control in the standard C++ library of Windows operating systems. It allows an attacker to elevate their privileges,...

SeaCMS Security Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version v.12.8, which originates from allowing an attacker to execute arbitrary code via the...

PT-2023-28117 · Dotsquares · Dotsquares Wp Custom Post Template

Name of the Vulnerable Software and Affected Versions: Dotsquares WP Custom Post Template versions prior to 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on...

WordPress Plugin WP Custom Post Template Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

ThingsBoard Server-Side Template Injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

GHSA-6PGR-J9V4-XFVV ThingsBoard Server-Side Template Injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

Sql injection

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

SUSE CVE-2023-43665

In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars and words methods when used with html=True are subject to a potential DoS denial of service attack via certain inputs with very long, potentially malformed HTML text. The chars and words...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

CVE-2023-45303

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...

ThingsBoard Injection Vulnerability

Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in ThingsBoard versions prior to 3.5, which stems from the presence of a server-side template injection vulnerability...

CVE-2023-45303

ThingsBoard before 3.5 is affected by a Server-Side Template Injection via Apache FreeMarker’s freemarker.template.utility.Execute when users can modify an email template and content is sent to /api/admin/settings. Connected sources (Red Hat, OSV, GHSA, CNNVD, CVE lists) confirm the injection roo...

Cross Site Scripting (XSS)

github.com/golang/go is vulnerable to Cross Site Scripting XSS. The vulnerability is caused by a lack of proper handling of occurrences of context. This will make the template parser incorrectly conclude the script context resulting in XSS...

WordPress Plugin Email Template Designer - WP HTML Mail Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Email Template...

Medium: golang

Issue Overview: The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to...

Cross-Site Scripting (XSS)

The html/template package is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability exists due to improper output escaping which allows an attacker to inject and execute arbitrary javascript...

CMS Made Simple <= 2.2.21 Multiple Vulnerabilities

CMS Made Simple is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple...