Количество 6
Количество 6
CVE-2022-29078
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
CVE-2022-29078
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
CVE-2022-29078
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
CVE-2022-29078
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js ...
GHSA-phwq-j96m-2c2q
ejs template injection vulnerability
BDU:2022-04347
Уязвимость функции outputFunctionName каркаса веб-приложений ejs для Node. js, позволяющая нарушителю выполнить произвольные команды
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2022-29078 The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
 | CVE-2022-29078 The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
 | CVE-2022-29078 The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation). | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
| CVE-2022-29078 The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js ... | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
| GHSA-phwq-j96m-2c2q ejs template injection vulnerability | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
 | BDU:2022-04347 Уязвимость функции outputFunctionName каркаса веб-приложений ejs для Node. js, позволяющая нарушителю выполнить произвольные команды | CVSS3: 9.8 | 93% Критический | почти 4 года назад |
Уязвимостей на страницу