Arbitrary Code Execution

Overview swig-templates is an A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig. Affected versions of this package are vulnerable to Arbitrary Code Execution via the renderFile method. Note: The following conditions are required to...

CVE-2023-23630 Cross-site (XSS) vulnerability with Express API in Eta

Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly to res.render...

CVE-2023-23630

CVE-2023-23630 affects Eta, a JS templating engine used with Node/Express; the XSS vulnerability exists when user-supplied data is passed to res.render. Root cause is improper handling of input leading to script injection. The issue has been fixed in Eta v2.0.0. Workarounds include not passing us...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2023-24422 Sour...

org.jenkins-ci.plugins:templating-engine (>=2.2, <=2.5.3) potentially affected by CVE-2023-24422 via org.jenkins-ci.plugins:script-security (1.76)

org.jenkins-ci.plugins:script-security MAVEN version 1.76 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.2, =2.5.3 Source cves: CVE-2023-24422...

Updated php-smarty packages fix security vulnerability

It was discovered that there was a potential cross-site scripting vulnerability in smarty3, a widely-used PHP templating engine. In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smartyfunctionmailto, and that could be parameterized...

Json2html vulnerable to cross-site scripting

Json2html is a client side javascript HTML templating library with wrappers for both jQuery and Node.js. A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross si...

GHSA-79MP-CXP4-9P6R Json2html vulnerable to cross-site scripting

Json2html is a client side javascript HTML templating library with wrappers for both jQuery and Node.js. A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross si...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2022-45379 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2022-45379 Sour...

org.jenkins-ci.plugins:templating-engine (>=2.2, <=2.5.3) potentially affected by CVE-2022-45379 via org.jenkins-ci.plugins:script-security (1.76)

org.jenkins-ci.plugins:script-security MAVEN version 1.76 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.2, =2.5.3 Source cves: CVE-2022-45379...

Cross-site Scripting (XSS)

Overview vapor/leaf-kit is an an expressive, performant, and extensible templating language built for Swift. Affected versions of this package are vulnerable to Cross-site Scripting XSS with untrusted user input. If an attacker managed to find a variable that was rendered with their unsanitized...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.5.3) potentially affected by CVE-2022-43409 via org.jenkins-ci.plugins.workflow:workflow-support (2.17)

org.jenkins-ci.plugins.workflow:workflow-support MAVEN version 2.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-support and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.5.3 Source cve...

org.jenkins-ci.plugins:templating-engine (>=2.3, <=2.5.3) potentially affected by CVE-2022-43407 via org.jenkins-ci.plugins:pipeline-input-step (2.12)

org.jenkins-ci.plugins:pipeline-input-step MAVEN version 2.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:pipeline-input-step and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.3, =2.5.3 Source cves:...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.5.3) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins.workflow:workflow-cps (2.53)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.53 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.5.3 Source cves:...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.5.3) potentially affected by CVE-2022-43402 via org.jenkins-ci.plugins.workflow:workflow-cps (2.53)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.53 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.5.3 Source cves:...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.5.3) potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins.workflow:workflow-cps (2.53)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 2.53 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.5.3 Source cves:...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2022-43404 Sour...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2022-43403 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2022-43403 Sour...

org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.1) potentially affected by CVE-2022-43401 via org.jenkins-ci.plugins:script-security (1.42)

org.jenkins-ci.plugins:script-security MAVEN version 1.42 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.1 Source cves: CVE-2022-43401 Sour...

org.jenkins-ci.plugins:templating-engine (>=2.2, <=2.5.3) potentially affected by CVE-2022-43404 via org.jenkins-ci.plugins:script-security (1.76)

org.jenkins-ci.plugins:script-security MAVEN version 1.76 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:templating-engine =2.2, =2.5.3 Source cves: CVE-2022-43404...