Use of Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information due to the default KeyGenerator process in the cache middleware not including query parameters when generating cache keys. An attacker can access or cause exposure of user-specific or...

Incorrect Behavior Order

Overview api-platform/core is a builds a fully-featured hypermedia or GraphQL API in minutes. Affected versions of this package are vulnerable to Incorrect Behavior Order due to the ItemNormalizer::isCacheKeySafe method. An attacker can access sensitive information by exploiting the improper cach...

Authorization Bypass

firefox/thunderbird is vulnerable to authorization bypass. A remote attacker is able to bypass the CORS preflight protection mechanisms via duplicate cache-key generation or retrieval of a value from an incorrect HTTP Access-Control- response header...