Pocoo vulnerabilities
4 vulnerabilities
Known vulnerabilities in Pocoo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2PrioritiseCVE-2021-42771debian · debian_linux +32 moredebian debian_linuxBabel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.CVSS7.8HighEPSS0.77%PrioritiseCVE-2019-8341opensuse · leap +3 moreopensuse leapAn issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxingCVSS9.8CriticalEPSS43.87%RoutineCVE-2014-1402pocoo · jinja2 +8 morepocoo jinja2The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.CVSS4.4MediumEPSS0.38%RoutineCVE-2014-0012pocoo · jinja2 +7 morepocoo jinja2FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.CVSS4.4MediumEPSS0.43%