600 matches found
Exploit for CVE-2024-7954
🚀 SPIP Unauthenticated RCE Exploit !Exploit Execution./img...
CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...
CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...
@aofl/cli (>=4.0.0-alpha.0, <=4.0.0-alpha.45), @aofl/html-webpack-purify-internal-css-plugin (>=4.0.0-alpha.22, <=4.0.0-alpha.45) +4 more potentially affected by CVE-2024-38987 via @aofl/cli-lib (4.0.0-alpha.45)
@aofl/cli-lib NPM version 4.0.0-alpha.45 is affected by a known vulnerability. The following packages have a transitive dependency on @aofl/cli-lib and may be impacted: - @aofl/cli =4.0.0-alpha.0, =4.0.0-alpha.22, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.45...
org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2024-39459 via org.jenkins-ci.plugins:plain-credentials (1.7)
org.jenkins-ci.plugins:plain-credentials MAVEN version 1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:plain-credentials and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves: CVE-2024-39459...
Medium: python3-jinja2
Issue Overview: Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application...
Amazon Linux 2 : python-jinja2 (ALAS-2024-2574)
The version of python-jinja2 installed on the remote host is prior to 2.7.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2574 advisory. Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing...
Fedora: Security Advisory for rust-handlebars (FEDORA-2024-40ee18b2e7)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 39 Update: rust-handlebars-5.1.2-2.fc39
Handlebars templating implemented in Rust...
EulerOS 2.0 SP12 : python-jinja2 (EulerOS-SA-2024-1772)
According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible t...
Fedora: Security Advisory for rust-handlebars (FEDORA-2024-ce2936b568)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: rust-handlebars-5.1.2-2.fc40
Handlebars templating implemented in Rust...
Stacklok Minder vulnerable to denial of service from maliciously crafted templates
Minder engine is susceptible to a denial of service from memory exhaustion that can be triggered from maliciously created templates. Minder engine uses templating to generate strings for various use cases such as URLs, messages for pull requests, descriptions for advisories. In some cases can the...
Cross-Site Scripting (XSS)
illuminate/view is vulnerable to a Cross-site Scripting XSS. The vulnerability is due to inadequate input sanitization within blade templating, allowing attackers to inject malicious scripts into rendered views...
Laravel Cross-site Scripting (XSS) vulnerability in blade templating
Laravel 7.1.2 addresses a possible XSS related attack vector in the Laravel 7.x Blade Component tag attributes when users are allowed to dictate the value of attributes. All Laravel 7.x users are encouraged to upgrade as soon as possible...
GHSA-297G-XG4H-7W4C Laravel Cross-site Scripting vulnerability in blade templating
Laravel is prone to a Cross-site Scripting vulnerability in blade templating...
Laravel Cross-site Scripting vulnerability in blade templating
Laravel is prone to a Cross-site Scripting vulnerability in blade templating...
PT-2024-40017 · Laravel · Laravel
Name of the Vulnerable Software and Affected Versions: Laravel affected versions not specified Description: The issue is related to a Cross-site Scripting vulnerability in the blade templating of Laravel. Recommendations: At the moment, there is no information about a newer version that contains ...
AZL-40420 CVE-2024-34064 affecting package nodejs for versions less than 20.14.0-1
Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as...
org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2024-34145 via org.jenkins-ci.plugins:script-security (1.42)
org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2024-34145 Sour...