GHSA-9436-3GMP-4F53 grav Server-side Template Injection (SSTI) mitigation bypass

Summary The fix for SSTI using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value from isDangerousFunction, which allows to execute the payload prepending double backslash \ Details The isDangerousFunction check in...

CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection Vulnerability

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...

The vulnerability of the Java framework for securing industrial applications, Spring Security, is related to the use of “***” as a template in the Spring Security configuration for WebFlux. This allows attackers to circumvent existing security restrictions.

The vulnerability of the Java framework for securing industrial applications using Spring Security is related to the use of “” as a template in the Spring Security configuration for WebFlux. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remote...

CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI)

Exploit Title: CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection SSTI Application: CmsMadeSimple Version: v2.2.17 Bugs: SSTI Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 13-07-2023...

CVE-2023-37897 Server-side Template Injection (SSTI) in grav

Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection SSTI vulnerability. The fix for another SSTI vulnerability using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value fr...

CVE-2023-37897

Grav SSTI CVE-2023-37897 affects Grav’s Twig engine due to a denial-list bypass introduced in the fix for a prior SSTI vulnerability. The isDangerousFunction() function returns false when a backslash is found, allowing payloads such as {{ ['id'] | map('\system') | join() }} to bypass the denylist...

CVE-2023-37480

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb...

CVE-2023-37480 Fides Webserver Vulnerable to Zip Bomb File Uploads

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb...

CVE-2023-37480 Fides Webserver Vulnerable to Zip Bomb File Uploads

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service DoS attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb...

Fides 资源管理错误漏洞

Fides is an open source privacy engineering platform for managing the implementation of data privacy requests in the runtime environment and the enforcement of privacy regulations in code. A resource management error vulnerability exists in Fides versions 2.11.0 through 2.15.1, which is rooted in...

WordPress Template Manager for Gutenberg Block Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Template Manager for Gutenberg Block Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 011e9bd91ed5 Credits Rafie Muhamma...

The vulnerability of the Active Template Library (ATL) in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Active Template Library ATL in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

GHSA-7GJ7-224W-VPR3 Spring-boot-admin sandbox bypass via crafted HTML

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there is write access ...

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

Design/Logic Flaw

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin aka Spring Boot Admin through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI Server Side Template Injection and code execution in spring-boot-admin if MailNotifier is enabled and there i...

Malicious code in perimeterx-fastly-js-edge-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 934118ad5800d3dc8e17c6e7ed99b345399d4eae19e298de4f8a35834f872cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-679 Malicious code in perimeterx-fastly-js-edge-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 934118ad5800d3dc8e17c6e7ed99b345399d4eae19e298de4f8a35834f872cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bazaar Social Listing Shopping Web PHP Template 2.3.2 Cross Site Scripting

==================================================================================================================================== | Title : Bazaar Social Listing Shopping Web PHP Template v2.3.2 XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser :...

PT-2023-26346 · Thymeleaf +1 · Thymeleaf +1

Name of the Vulnerable Software and Affected Versions: Thymeleaf versions 3.1.1.RELEASE and earlier spring-boot-admin versions 3.1.1 and earlier Description: The issue allows for a sandbox bypass via crafted HTML, which may be relevant for Server Side Template Injection SSTI and code execution in...

CVE-2023-38286

Thymeleaf 3.1.1.RELEASE (used in Spring Boot Admin up to 3.1.1) is affected by a sandbox bypass via crafted HTML, enabling potential SSTI and code execution if MailNotifier is enabled with write access to environment variables in the UI. Affected products: Thymeleaf 3.1.1.RELEASE and Spring Boot ...