GHSA-7H5P-MMPP-HGMM Nuclei Template Signature Verification Bypass

Summary A vulnerability has been identified in Nuclei's template signature verification system that could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. Affected Component The vulnerability is present in the template signature...

Nuclei Template Signature Verification Bypass

Summary A vulnerability has been identified in Nuclei's template signature verification system that could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. Affected Component The vulnerability is present in the template signature...

CVE-2024-45053

Fides (open‑source privacy engineering platform) is affected by a Server‑Side Template Injection in the Email Templating feature using Jinja2, allowing Remote Code Execution by privileged Admin UI users. Cloaked between versions 2.19.0 and before 2.44.0, the issue arises from insufficient input s...

CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

CVE-2024-43405 Nuclei Template Signature Verification Bypass

Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code...

WordPress Sensei LMS plugin < 4.24.2 - Unauthenticated Email Template Leak vulnerability

Unauthenticated Email Template Leak vulnerability discovered by Sushmita Poudel in WordPress Plugin Sensei LMS versions 4.24.2...

CVE-2024-7786 Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates...

Template Injection

@blakeembrey/template is vulnerable to Template Injection. The vulnerability is due to insufficient validation of the template name within the file index.ts, allowing untrusted input to be used as the template display name...

PT-2024-31405

Name of the Vulnerable Software and Affected Versions Fides versions 2.19.0 through 2.43.x Description The Email Templating feature in Fides uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

CVE-2024-45390

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

GHSA-Q765-WM9J-66QJ @blakeembrey/template vulnerable to code injection when attacker controls template input

Impact It is possible to inject and run code within the template if the attacker has access to write the template name. js const template = require'@blakeembrey/template'; template"Hello name!", "exploit && = console.log'success'; && function pwned"; Patches Upgrade to 1.2.0. Workarounds Don't pa...

@blakeembrey/template vulnerable to code injection when attacker controls template input

Impact It is possible to inject and run code within the template if the attacker has access to write the template name. js const template = require'@blakeembrey/template'; template"Hello name!", "exploit && = console.log'success'; && function pwned"; Patches Upgrade to 1.2.0. Workarounds Don't pa...

CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

CVE-2024-45390

The CVE-2024-45390 entry concerns the @blakeembrey/template string template library. Prior to version 1.2.0, there is a vulnerability where an attacker who can write the template name can inject and run code within the template. A patch was included in version 1.2.0. Remediation guidance from the...

golang: html/template: errors returned from MarshalJSON methods may break template escaping

A flaw was found in Go's html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into...

Template 安全漏洞

Template is a quick and easy string template by Blake Embrey Personal Developer. A security vulnerability exists in Template versions prior to 1.2.0 that stems from the ability to inject and run code in a template if an attacker is authorized to write the template name...

PT-2024-31594 · Npm · @Blakeembrey/Template

Name of the Vulnerable Software and Affected Versions: @blakeembrey/template versions prior to 1.2.0 Description: The issue allows an attacker to inject and run code within the template if they have access to write the template name. This can be achieved by exploiting the template display name...