1313 matches found
Twig has unguarded calls to `__toString()` when nesting an object into an array
Description In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. Resolution The sandbox mode now checks the toString meth...
CVE-2024-51754 Unguarded calls to __toString() when nesting an object into an array in Twig
Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...
CVE-2024-51754
Twig (PHP template engine) is affected by a vulnerability where in a sandbox an attacker can call __toString() on an object when the object is part of an array or function argument, bypassing security policy. The issue has concrete fixes: Twig 3.11.2 and 3.14.1 include patches. Affected versions ...
CVE-2024-51754 Unguarded calls to __toString() when nesting an object into an array in Twig
Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...
CVE-2024-51754 Unguarded calls to __toString() when nesting an object into an array in Twig
Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...
CVE-2024-51754
Twig is a template language for PHP. In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an argument list arguments to a function or a filter for instance. This issue has been patched in...
CVE-2024-51755 Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. This issue has...
CVE-2024-51755 Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. This issue has...
CVE-2024-51755
Twig is a PHP templating engine. CVE-2024-51755 describes a sandbox vulnerability where an attacker could access attributes of Array-like objects because policy checks were not applied before the __isset() call; the check now occurs via the property policy and then __isset() is invoked. This conf...
CVE-2024-51755 Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the isset method is now called after the security check. This is a BC break. This issue has...
Twig 安全漏洞
Twig is a PHP template engine open-sourced by Twig. Twig has a security vulnerability that stems from the fact that when an object is part of an array or parameter list in a sandbox, an attacker can call the toString method on the object even if the security policy does not allow it...
Twig 安全漏洞
Twig is a PHP template engine open-sourced by Twig. A security vulnerability exists in Twig that stems from array-like object properties in the sandbox not being checked against a security policy...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the addattributes Twig function. PoC php Dangerous user supplied variable % set payload = 'alertxss' % Here, Twig escapes it payload Here it is not escaped alertxss' foo Details...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to unsanitized attribute values by the link Twig function. PoC php Dangerous user supplied variable % set payload = 'alertxss' % Here, Twig escapes it payload Here it is not escaped linkpayload,...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the bem Twig function. Note: This is only exploitable when the function is used outside of Drupal. If the Drupal Attribute class exists, the function uses it and it does escape...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization in |markdown filter. An attacker to inject arbitrary JS into the page, by entering Markdown and then renders it with this filter. Note: Filters that use issafe need to make sure the...
Debian: Security Advisory (DSA-5771-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 5771-1] php-twig security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 17, 2024 https://www.debian.org/security/faq -...
Debian dsa-5771 : php-twig - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5771 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5771-1 [email protected] https://www.debian.org/security/ Moritz...