GHSA-CQH3-JG8P-336J Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Summary An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Root Cause File:...

eZ Platform CSRF token in login form is disabled by default

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery CSRF token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and...

Information Disclosure

sulu/sulu is vulnerable to Observable Response Discrepancy. The vulnerability exists due to the insecure access control used in the security.yaml configuration, which allows an attacker to detect whether a user's username or email exists and which ones do not exist through the Admin Login form...