1314 matches found
WordPress plugin WPML 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
Server-Side Template Injection (SSTI)
shopware/core and shopware/platform is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper escaping of the swsilentfeaturecall parameter in Twig templates, allowing execution of code through unescaped feature flag names...
Server-Side Template Injection
shopware/core and shopware/platform is vulnerable to Server-Side Template Injection. The vulnerability is due to improper handling of the context variable in Twig templates, allowing attackers with Administration access to execute arbitrary PHP functions or methods...
CVE-2024-42356
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
CVE-2024-42355
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...
CVE-2024-42356
CVE-2024-42356 affects Shopware (open commerce platform). The issue arises from the Twig context variable, which can be injected into most Twig templates and, via a scoped Context helper, enables calling statically callable PHP functions from Twig. This can leak language/currency context and, wit...
GHSA-35JP-8CGG-P4WJ Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
Impact The context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a helper with a callable function. Example call from PHP: php...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42355 Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Shopware, an open ecommerce platform, has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. Prior to versions 6.6.5.1 and 6.5.8.13, it accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and...
CVE-2024-42355
Shopware is vulnerable to Server-Side Template Injection via the new Twig tag sw_silent_feature_call. The parameter (feature flag name) is not escaped properly, allowing code execution. Affected versions include 6.6.5.0/6.5.x prior to 6.6.5.1 and 6.5.8.13; older 6.2–6.4 can receive protections vi...
GHSA-27WP-JVHW-V4XP Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Impact Shopware has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Patches Update to Shopware 6.6.5.1 or...
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
Impact Shopware has a new Twig Tag swsilentfeaturecall which silences deprecation messages while triggered in this tag. It accepts as parameter a string the feature flag name to silence, but this parameter is not escaped properly and allows execution of code. Patches Update to Shopware 6.6.5.1 or...
Shopware 安全漏洞
Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware versions 6.6.5.1 and 6.5.8.13 and earlier, which stems from the fact that the vulnerability originates from its new Twig tag, which is used to mute discarded...
Shopware 安全漏洞
Shopware is a suite of open source e-commerce software from the German company Shopware. A security vulnerability exists in Shopware, which stems from a lack of restriction on the context variable, allowing any statically callable PHP function to be called via Twig...