284 matches found
CVE-2022-31140 Valinor error messages leading to potential data exfiltration
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use ThrowablegetMessage when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database...
CVE-2022-31140 Valinor error messages leading to potential data exfiltration
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use ThrowablegetMessage when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database...
CVE-2022-31140
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use "ThrowablegetMessage" when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database...
CVE-2022-31140: Generation of Error Message Containing Sensitive Information
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use ThrowablegetMessage when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database...
PT-2022-20559
Name of the Vulnerable Software and Affected Versions Valinor versions prior to 0.12.0 Description Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use ThrowablegetMessage when it should not have permission to ...
PHP Library Remote Code Execution Vulnerability
Several PHP compatibility libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existing vulnerable code. Affected components include the WassUp Realtime analytics WordPress plugin, AjaXplorer Core, and more. JAHx221 - RCE in copy/pasted...
Popular PyPI Package 'ctx' and PHP Library 'phpass' Hijacked to Steal AWS Keys
Two trojanized Python and PHP packages have been uncovered in what's yet another instance of a software supply chain attack targeting the open source ecosystem. One of the packages in question is "ctx," a Python module available in the PyPi repository. The other involves "phpass," a PHP package...
CVE-2022-30450
A Remote Code Execution RCE vulnerability exists in waimairen 9.1 via wx.php...
CVE-2022-30062
ftcms =2.1 was discovered to be vulnerable to Arbitrary File Read via tp.php...
Git-PHP 参数注入漏洞
Git-PHP is a library. for using Git repositories in PHP. A parameter injection vulnerability exists in czproject/git-php versions prior to 4.0.3, which stems from vulnerability to command injection via git parameter injection...
The vulnerability of the SPL extension for the PHP programming language allows a hacker to execute arbitrary PHP code.
The vulnerability of the PHP programming language interpreter’s SPL extension relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary PHP code using specially created serialized data...
CVE-2021-46743
In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue e.g., RS256 / HS256 exists via the kid aka Key ID header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way t...
Cross site scripting
svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the svg-sanitizer library prior to version 0.15.0. This issue is fixed in version 0.15.0. There is currently no workaround available...
Multiple Plugins - Reflected Cross-Site Scripting via PHPRelativePath Library
The plugins are using the PHPRelativePath library, which contain an example file affected a Reflected Cross-Site Scripting POST /wp-content/plugins/mpl-publisher/vendor/grandt/relativepath/RelativePath.Example1.php HTTP/1.1 Accept:...
USN-4779-1: Gettext vulnerability
Danilo Segan discovered that Gettext mishandled certain input. An attacker could use this vulnerability to execute arbitrary code...
CVE-2018-20583
Cross-site scripting XSS vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML even if allowunsafelinks is false via a newline character e.g., writing javascript as javascri%0apt...
[SECURITY] Fedora 28 Update: php-simplesamlphp-saml2-2.3.8-1.fc28
A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp 1, used by OpenConext 2. This library started as a collaboration between UNINETT 3 and SURFnet 4 but everyone is invited to contribute. Autoloader: /usr/share/php/SAML2/autoload.php 1 https://www.simplesamlphp.org/ 2...
[SECURITY] Fedora 28 Update: php-simplesamlphp-saml2_3-3.1.4-3.fc28
A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp 1, used by OpenConext 2. This library started as a collaboration between UNINETT 3 and SURFnet 4 but everyone is invited to contribute. Autoloader: /usr/share/php/SAML23/autoload.php 1 https://www.simplesamlphp.org/ 2...
[SECURITY] Fedora 28 Update: php-simplesamlphp-saml2_1-1.10.6-1.fc28
A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp 1, used by OpenConext 2. This library started as a collaboration between UNINETT 3 and SURFnet 4 but everyone is invited to contribute. Autoloader: /usr/share/php/SAML21/autoload.php 1 https://www.simplesamlphp.org/ 2...
[SECURITY] Fedora 27 Update: php-simplesamlphp-saml2_1-1.10.6-1.fc27
A PHP library for SAML2 related functionality. Extracted from SimpleSAMLphp 1, used by OpenConext 2. This library started as a collaboration between UNINETT 3 and SURFnet 4 but everyone is invited to contribute. Autoloader: /usr/share/php/SAML21/autoload.php 1 https://www.simplesamlphp.org/ 2...