CVE-2021-22053

CVE-2021-22053 affects Spring Cloud Netflix Hystrix Dashboard prior to 2.2.10 when used with spring-boot-starter-thymeleaf. The vulnerability arises because request URI path data is evaluated as SpringEL expressions during view template resolution (example: /hystrix/monitor;[data]), enabling remo...

CVE-2021-22053: Improper Control of Generation of Code

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

PT-2021-14848

Name of the Vulnerable Software and Affected Versions spring-cloud-netflix-hystrix-dashboard versions affected versions not specified Description The issue affects applications that use both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf. It exposes a way to execute code...

Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data , the path elements following...

GHSA-QCJ6-JQRG-4WP2 Template injection in thymeleaf-spring5

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

Template injection in thymeleaf-spring5

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

Remote code execution

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466: Improper Control of Generation of Code

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

Thymeleaf-Spring5 code injection vulnerability

Thymeleaf-Spring5 is an open source, modern, server-side Java template engine for web and standalone environments from the Thymeleaf team. A security vulnerability exists in Thymeleaf-Spring5, which arises from a networked system or product that does not properly filter specific elements of...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution...

CVE-2021-43466

CVE-2021-43466 affects thymeleaf-spring5, specifically the 3.0.12 release, where template injection in Thymeleaf can lead to remote code execution. The vulnerability is tied to thymeleaf-spring5 usage and template rendering scenarios that enable code execution. Remediation in the provided docs re...

PT-2021-23849 · Unknown · Thymeleaf-Spring5

Name of the Vulnerable Software and Affected Versions: thymeleaf-spring5 version 3.0.12 Description: The issue in thymeleaf-spring5 may lead to remote code execution when thymeleaf is combined with specific scenarios in template injection. Recommendations: For thymeleaf-spring5 version 3.0.12, at...

net.simpledynamics:openid-connect-server-spring-boot-config (>=0.1.0, <=0.1.3), net.simpledynamics:openid-connect-server-spring-boot-samples-default (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2021-26715 via org.mitre:openid-connect-server (>=1.1.0, <=1.3.3)

org.mitre:openid-connect-server MAVEN version =1.1.0, =0.1.0, =0.1.0, =0.1.0, =0.11, =1.1.0, =1.2.0-rc1, =1.2.0-rc1, =1.3.3 Source cves: CVE-2021-26715 Source advisory: OSV:GHSA-792R-MH2Q-P8QP...

forum.thymeleaf.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181381 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...