5484 matches found
CVE-2022-47896
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...
CVE-2022-47896
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...
Code injection
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...
CVE-2022-47896
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...
CVE-2022-47896
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks...
JetBrains IntelliJ IDEA 代码注入漏洞
JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2022.3.1, which stems from a code template that is susceptible to SSTI attacks...
WordPress plugin Jeg Elementor Kit 安全漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. iframe is an inline frame used to embed another document into the current HTML document.Elementor is a website builder that allows WordPress users to crea...
CVE-2021-4274
A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument requestargs leads to cross site scripting. The attack may be initiated remotely. The name of the...
CVE-2021-4274
A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument requestargs leads to cross site scripting. The attack may be initiated remotely. The name of the...
Cross site scripting
A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument requestargs leads to cross site scripting. The attack may be initiated remotely. The name of the...
BIRD-LG 跨站脚本漏洞
BIRD-LG is a routing daemon by the individual developer Mehdi ABAAKOUK. BIRD-LG has a security vulnerability that stems from some unknown handling of the file templates/layout.html, which manipulates the parameter requestargs to cause cross-site scripting...
Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog. To simulate a gadget chain, put the following code in a plugin: class Evil public...
Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog. PoC To simulate a gadget chain, put the following code in a plugin: class Evil...
CVE-2022-44588
creationtimestamp| type| source ---|---|--- 2022-12-15 22:30:03+00:00| seen| https://t.me/cibsecurity/54640 2026-02-21 18:54:48+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-44588.yaml 2026-02-25 21:02:30+00:00| seen|...
CVE-2022-3073
The CVE-2022-3073 entry concerns Quanos SCHEMA ST4 example web templates (Bootstrap 2019 v2 through 2022 SP1 v1). Affected component is the *-schema.js script, whose JavaScript injection vulnerability can allow a remote attacker to hijack existing sessions or run scripts in a user’s browser. Docu...
CVE-2022-3073 Quaonos Schema ST4 example templates prone to XSS
Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...
CVE-2022-4223
creationtimestamp| type| source ---|---|--- 2022-12-13 18:27:55+00:00| seen| https://t.me/cibsecurity/54425 2026-01-22 00:26:29+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-4223.yaml 2026-01-23 21:03:00+00:00| seen|...
openstack-tripleo-heat-templates: data leak of internal URL through keystone_authtoken
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...
DEBIAN-CVE-2022-45132
In Linaro Automated Validation Architecture LAVA before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API endpoint for validating device configuration files in lava-server loads input as a Jinja2 template in a way that can be used to trigger...
LAVA 代码注入漏洞
LAVA is a continuous integration system from LAVA open source. It is used to deploy operating systems to physical and virtual hardware to run tests. A security vulnerability exists in versions of LAVA prior to 2022.11.1 that stems from its REST API endpoint for validating device profiles loading...