Поиск уязвимостей

Jinja vulnerable to Cross-Site Scripting (XSS)

Jinja is an extensible templating engine. Special placeholders in the ...

** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing.

Уязвимость функции from_string шаблонизатора Jinja2 для языка программирования Python, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации

Moderate: python-jinja2 security update

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

ELSA-2024-3102: python-jinja2 security update (MODERATE)

ELSA-2024-2348: python-jinja2 security update (MODERATE)

Уязвимость фильтра xmlattr шаблонизатора Jinja2 для языка программирования Python, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)

Security update for python-Jinja2

Security update for python-Jinja2

Security update for python-Jinja2

Уязвимость python3-jinja2

ALT-PU-2024-1260: package `python3-module-jinja2` update to version 3.1.3-alt1

Security update for python-Jinja2

Security update for python-Jinja2

Security update for python-Jinja2

Security update for python-Jinja2

ALT-PU-2019-2664: package `python-module-jinja2` update to version 2.10.1-alt1

Moderate: fence-agents security and bug fix update