CVE-2021-46117

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

Remote code execution

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46118

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKitdoSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code...

CVE-2021-46118

CVE-2021-46118 affects jpress 4.2.0, enabling remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel allows editing email templates, which can be exploited to inject malicious code. While multiple sources describe the vulnerability as RCE with high se...

xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl

A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality,...

CVE-2021-46117

CVE-2021-46117 affects jpress 4.2.0 and enables remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The issue arises because the admin panel allows editing email templates, enabling attackers to inject malicious code. Publicly disclosed details in the provided documents con...

Windows Update has changed over the years. Here are 25 group policies to avoid

Microsoft has published a list of 25 group policies that administrators should not use in Windows 10 and Windows 11 as they do not provide optimal behavior or cause unexpected results. Since November 2015 when Windows 10 was first introduced, there have been many changes and some of them have...

CVE-2021-45380

AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inchead.php...

Cross site scripting

AppCMS 2.0.101 has a XSS injection vulnerability in \templates\m\inchead.php...

Possible RCE when rendering untrusted user templates

Fix CVE-2022-0323, possible RCE when rendering untrusted user templates, reported by @altm4n via huntr.dev Improve compatibility with PHP 8.1...

Possible RCE when rendering untrusted user templates

Fix CVE-2022-0323, possible RCE when rendering untrusted user templates, reported by @altm4n via huntr.dev - Improve compatibility with PHP 8.1...

Content Injection

Overview Affected versions of this package are vulnerable to Content Injection. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability,...

GHSA-36M2-8RHX-F36J Sandbox bypass in Latte templates

Impact The problem affects users who use the sandbox in Latte and templates from untrusted sources. Patches Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. References The issues were discovered by - JinYiTong https://github.com/JinYiTong - 赵钰迪...

Sandbox bypass in Latte templates

Impact The problem affects users who use the sandbox in Latte and templates from untrusted sources. Patches Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. References The issues were discovered by - JinYiTong https://github.com/JinYiTong - 赵钰迪...

GHSA-59J4-WJWP-MW9M Sandbox Bypass in Apache Velocity Engine

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

CVE-2021-46068

creationtimestamp| type| source ---|---|--- 2022-01-06 18:41:12+00:00| seen| https://t.me/cibsecurity/35057 2022-01-14 18:06:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1325 2023-04-27 09:58:59+00:00| confirmed|...

CVE-2021-43947

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution RCE vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665...

CVE-2021-43947

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution RCE vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665...

Remote code execution

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution RCE vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665...

CVE-2021-43947

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution RCE vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665...