PT-2017-6442

Name of the Vulnerable Software and Affected Versions Apache Roller versions 5.1 through 5.1.1 Description The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language VTL in the weblog page template...

Mis-configuration of Apache Velocity template engine used to send emails in GigaCC OFFICE

Overview GigaCC OFFICE provided by WAM!NET Japan K.K. contains mis-configuration of Apache Velocity template engine which is used to send emails. WAM!NET Japan K.K. and the following people reported these vulnerabilities to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and...

Liferay Portal Command Execution Vulnerability

Liferay is a J2EE-based portal solution that uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, an enterprise collaboration platform, a social network, and more. A command execution vulnerability exists in Liferay Portal versions prior to 6.2.1...

Starbucks: Lack of Controls Allowing for Card and PIN Enumeration Leading to Fraud

Summary: The pages https://www.starbucks.com/account/card/addcard and https://www.starbucks.com/account/card/Balance do not properly enforce security controls to limit POST requests. This bug allows attackers to successfully hijack a loaded Starbucks card and transfer all the funds into their own...

Design/Logic Flaw

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

CVE-2010-5327

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

CVE-2010-5327

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

CVE-2010-5327

CVE-2010-5327 affects Liferay Portal up to version 6.2.10. The issue is a remote code execution via a crafted Velocity template, enabling remote authenticated users to execute arbitrary shell commands. The connected sources corroborate a velocity/template-based command injection in Liferay Portal...

CVE-2010-5327: Undefined Security Weakness

Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template...

PT-2017-4906

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions prior to 6.2.10 Description: The issue allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. Recommendations: For versions prior to 6.2.10, update to version 6.2.10 or...

Atlassian HipChat for Jira Plugin Velocity 模版注入

No description provided by source...

Atlassian HipChat for Jira Plugin - Velocity Template Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 "Atlassian HipChat for Jira Plugin Velocity Template Injection", 'Description' = %q Atlassian Hipchat is a web service...

Atlassian HipChat for Jira Plugin Velocity Template Injection Exploit

Atlassian Hipchat is a web service for internal instant messaging. A plugin is available for Jira that allows team collaboration at real time. A message can be used to inject Java code into a Velocity template, and gain code execution as Jira. Authentication is required to exploit this...

Atlassian HipChat for Jira Plugin Velocity Template Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 "Atlassian HipChat for Jira Plugin Velocity Template Injection", 'Description' = %q Atlassian Hipchat is a web service...

JIRA and HipChat for JIRA Plugin Velocity Template Injection Vulnerability

Exploit for java platform in category web applications JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability Date: 2015-08-26 CVE ID: CVE-2015-5603 Vendor Link: https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html...

JIRA and HipChat for JIRA Plugin - Velocity Template Injection

JIRA and HipChat for JIRA Plugin - Velocity Template Injection JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability Date: 2015-08-26 CVE ID: CVE-2015-5603 Vendor Link:...

Atlassian HipChat for Jira Plugin Velocity Template Injection

Atlassian Hipchat is a web service for internal instant messaging. A plugin is available for Jira that allows team collaboration at real time. A message can be used to inject Java code into a Velocity template, and gain code execution as Jira. Authentication is required to exploit this...

CVE-2015-5603: JIRA and the HipChat For JIRA plugin - Velocity Template Injection

Note: the current version of this advisory can be found at https://confluence.atlassian.com/x/IcBKLg . CVE ID: CVE-2015-5603 Product: JIRA and the HipChat for JIRA plugin. Affected HipChat For JIRA plugin versions: 1.3.2 = version 6.30.0 Affected JIRA product versions: 6.3.5 = version 6.4.11...

CVE-2015-5603

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."...

Design/Logic Flaw

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."...