CVE-2024-46507

CVE-2024-46507: Yeti Platform prior to 2.1.12 contains a Server-Side Template Injection (SSTI) in the custom template export function that can lead to remote code execution on the application server. Exploitation requires valid credentials (authenticated user). Impact includes arbitrary command e...

CVE-2024-45412

The CVE-2024-45412 entry affects Yeti Platform versions prior to 2.1.11. The vulnerability arises from remote user-controlled data tags undergoing Unicode normalization with the NFKD form, which on Windows can be resource-intensive and lead to denial of service, potentially exacerbated by large p...

CVE-2024-46508

CVE-2024-46508 affects yeti-platform yeti before 2.1.12. The issue allows an attacker to generate valid JWT tokens if YETI_AUTH_SECRET_KEY remains at the default SECRET. CVSS v3.1 base score 7.5 (High) with Network attack vector and no privileges required. Root cause: secret key used for JWT sign...