CVE-2024-46507

The yeti-platform yeti (versions prior to 2.1.12 ) is vulnerable to a Server-Side Template Injection (SSTI) flaw located in the custom template export function . This vulnerability allows an attacker to inject malicious template expressions which, when evaluated by the server, can lead to Remote ...

CVE-2024-45412

The CVE-2024-45412 entry affects Yeti Platform versions prior to 2.1.11. The vulnerability arises from remote user-controlled data tags undergoing Unicode normalization with the NFKD form, which on Windows can be resource-intensive and lead to denial of service, potentially exacerbated by large p...

CVE-2024-46508

The yeti-platform (versions prior to 2.1.12 ) is vulnerable to an authentication bypass and privilege escalation flaw due to the use of hardcoded credentials . Specifically, the system allows attackers to generate valid JWT tokens without changing the YETI_AUTH_SECRET_KEY. Exploiting this vulnera...