15061 matches found
PT-2023-25893 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.39.3 Description: An issue was discovered in SiteLinksView.php in Wikibase. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from...
LDAP Active Directory - domainDNS Enumeration
Binary data ldapenumdomaindns.nbin...
CVE-2023-33570
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection SSTI...
Sql injection
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection SSTI...
CVE-2023-36467
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...
Remote code execution
AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 through 1.5.1 do not prevent remote code execution when a user injects Python commands into the ‘Template’ field when configuring a data pipeline. The issue...
CVE-2023-36467
CVE-2023-36467 concerns AWS data.all, an open-source data marketplace framework. The connected sources confirm that versions 1.2.0 through 1.5.1 are vulnerable to remote code execution when an authenticated user injects Python commands into the Template field during data pipeline configuration. T...
AWS data.all 代码注入漏洞
AWS data.all is an open source development framework open sourced by awslabs. A code injection vulnerability exists in AWS data.all versions 1.2.0 through 1.5.1, which stems from a code injection vulnerability that allows an authenticated attacker to inject Python commands into Template fields wh...
PT-2023-25581 · Alldata · Alldata
Name of the Vulnerable Software and Affected Versions: data.all versions 1.2.0 through 1.5.1 Description: The issue concerns remote code execution when a user injects Python commands into the Template field while configuring a data pipeline. This can only be triggered by authenticated users...
PT-2023-24395 · Bagisto · Bagisto
Name of the Vulnerable Software and Affected Versions: Bagisto version 1.5.1 Description: The issue is related to Server-Side Template Injection SSTI. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...
Webkul Software Bagisto 安全漏洞
Webkul Software Bagisto is an open source e-commerce framework from Indian company Webkul Software. A security vulnerability exists in Webkul Software Bagisto v1.5.1 that stems from susceptibility to server-side template injection SSTI attacks...
CVE-2023-33570
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection SSTI...
CVE-2023-33570
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection SSTI...
CVE-2023-33570
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection SSTI...
Arbitrary Code Injection
@backstage/plugin-scaffolder-backend is vulnerable to Arbitrary Code Injection. The vulnerability exists due to sandbox bypass in ScaffolderEntitiesProcessor.js, which allows an attacker with write access to a registered scaffolder template to inject code through the YAML template definition...
Deserialization Of Untrusted Data
Whaleal IceFrog is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in the aviator Template Engine which can result in code injection...
GHSA-CGMM-C2M9-FF7R jFinal Server-Side Template Injection vulnerability
Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...
jFinal Server-Side Template Injection vulnerability
Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...