600 matches found
Cross site scripting
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting XSS payload and send it to any system or device that sends logs to th...
CVE-2023-49950
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting XSS payload and send it to any system or device that sends logs to th...
CVE-2023-49950
Summary (concrete): CVE-2023-49950 affects Logpoint SIEM 6.10.0 through 7.x before 7.3.0. A vulnerability in Jinja templating fails to sanitize log data displayed in the Alert view when using a custom template, allowing a remote attacker to craft an XSS payload and potentially cause sensitive dat...
CVE-2023-49950
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting XSS payload and send it to any system or device that sends logs to th...
CVE-2023-49950: Improper Neutralization of Input During Web Page Generation
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a cross-site scripting XSS payload and send it to any system or device that sends logs to th...
Jinja2 xmlattr XSS
The vulnerability of the xmlattr filter in the Jinja2 templater relates to the lack of protective measures for website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...
PT-2024-13839 · Logpoint · Logpoint Siem
Name of the Vulnerable Software and Affected Versions: Logpoint SIEM versions 6.10.0 through 7.x before 7.3.0 Description: The Jinja templating in Logpoint SIEM does not correctly sanitize log data being displayed when using a custom Jinja template in the Alert view. A remote attacker can craft a...
org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2024-23899 via org.jenkins-ci.plugins:git-server (1.9)
org.jenkins-ci.plugins:git-server MAVEN version 1.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-server and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves: CVE-2024-23899 Source...
AZL-33349 CVE-2024-22195 affecting package nodejs18 for versions less than 18.20.3-3
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...
CVE-2024-22195
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...
AZL-35050 CVE-2024-22195 affecting package nodejs for versions less than 20.14.0-1
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...
CVE-2024-22195
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...
CVE-2024-22195
CVE-2024-22195 affects Jinja2: the xmlattr filter can accept keys/values that bypass escaping, enabling possible XSS via HTML attribute injection. Public notes show affected packages including python-jinja2 and jinja2, with fixes in 3.1.4 (e.g., Astra Linux entry indicates 3.1.4 as the patch). De...
CVE-2024-22195 Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja xmlattr filter can be abused t...
PT-2024-1412
Name of the Vulnerable Software and Affected Versions Jinja2 affected versions not specified Description Jinja is an extensible templating engine that allows writing code similar to Python syntax. The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing...
ansible: Template Injection
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...
GHSA-7J69-QFC3-2FQ9 Ansible template injection vulnerability
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...
DEBIAN-CVE-2023-5764
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...
AZL-32158 CVE-2023-5764 affecting package ansible for versions less than 2.14.12-2
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...
CVE-2023-5764
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...