CVE-2024-46507: Improper Control of Generation of Code

A SSTI server side template injection vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server...

Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE

The Yeti Platform " verified: true max-request: 4 tags: cve,cve2024,yeti,platform,ssti,rce,intrusive,vkev,vuln variables: username: "username" password: "password" http: - raw: - | POST /api/v2/auth/token HTTP/1.1 Host: Hostname Content-Type:...

The vulnerability of the YETI platform for collecting and analyzing data on cyber threats lies in the insufficient verification of input data. This allows a malicious actor to execute arbitrary code or carry out Server Side Template Injection (SSTI) attacks.

The vulnerability of the YETI platform for collecting and analyzing data on cyber threats is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or carry out Server Side Template Injection SSTI attacks...

The vulnerability of the Yeti threat analysis platform, which relies on the use of strictly encrypted credentials, allows attackers to escalate their privileges.

The vulnerability of the Yeti threat analysis platform is related to the use of strictly encrypted credentials. Exploiting this vulnerability allows a remote attacker to enhance their privileges by using a static JWT token...

CVE-2024-46507: Yeti Platform Server-Side Template Injection (SSTI)

The post CVE-2024-46507: Yeti Platform Server-Side Template Injection SSTI appeared first on Rhino Security Labs...

PT-2024-10438

Name of the Vulnerable Software and Affected Versions Yeti platform affected versions not specified Description The issue is related to the use of hardcoded credentials. An attacker can exploit this to gain elevated privileges by utilizing a static JWT token. Recommendations At the moment, there ...

Yeti Platform 安全漏洞

Yeti Platform is a daily threat intelligence platform open-sourced by Yeti Platform. A security vulnerability exists in Yeti Platform versions prior to 2.1.11, which stems from a denial-of-service attack in which remote user-controlled data tags can be Unicode normalized via the compatibility for...