1709 matches found
Cross site scripting vulnerability in Javascript escaping
Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the...
TYPO3-EXT-SA-2023-002: Persisted Cross-Site Scripting in extension "Forms Export" (frp_form_answers)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-002...
CVE-2022-24894: Prevent storing cookie headers in HttpCache
More info at https://symfony.com/cve-2022-24894...
TYPO3-CORE-SA-2022-006: Denial of Service in Page Error Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-006...
TYPO3-CORE-SA-2022-011: By-passing Cross-Site Scripting Protection in HTML Sanitizer
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-011...
TYPO3-CORE-SA-2022-003: Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-003...
Path Disclosure within joomla/filesystem class
More info at https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html...
Variable Tampering within joomla/input class
More info at https://developer.joomla.org/security-centre/876-20220307-core-variable-tampering-on-jinput-request-data.html...
TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-015...
TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-014...
Improper escaping of command arguments on Windows leading to command injection
Impact Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. Patches 1.10.23 and 2.1.9 fix the issue Workarounds None...
template_object Sandbox Escape PHP Code Injection
More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...
TYPO3-CORE-SA-2020-007: Potential Privilege Escalation
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-007...
TYPO3-CORE-SA-2020-001: Information Disclosure in Password Reset
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-001...
CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy
More info at https://symfony.com/cve-2020-5275...
Relative Path Traversal (CWE-23) in chunked uploads
Description Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validati...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...
Exposed suppressed username or log in Special:EditTags
More info at https://phabricator.wikimedia.org/T222036...
CVE-2018-11406: CSRF Token Fixation
More info at https://symfony.com/cve-2018-11406...
Highly critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-002...
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...
SQL injection vulnerabililty in the front end listing module
More info at https://contao.org/en/news/contao-448.html...
Multiple timing side-channel issues
More info at https://simplesamlphp.org/security/201703-01...
Incorrect signature verification
More info at https://simplesamlphp.org/security/201612-02...
Form API ignores access restrictions on submit buttons
More info at https://www.drupal.org/SA-CORE-2016-001...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
XXE/XEE vector when using ZendXml on multibyte payloads
More info at https://framework.zend.com/security/advisory/ZF2015-06...
Cross-Site Scripting in 3rd party library Flowplayer
More info at https://typo3.org/security/advisory/typo3-core-sa-2015-007...
XEE issue that could expose local files or easily trigger a DOS attack.
XXE security issue. Issue 414...
Request::getHost() poisoning
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
DOS attack in FOSUserBundle login form
More info at https://symfony.com/cve-2013-5750...
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007
More info at https://www.drupal.org/sa-core-2020-007...
Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009
More info at https://www.drupal.org/sa-core-2020-009...
Moderately critical - Cross Site Scripting
More info at https://www.drupal.org/sa-core-2018-003...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...
Unguarded calls to __toString() when nesting an object into an array
More info at https://symfony.com/blog/cve-2024-51754-unguarded-calls-to-tostring-in-a-sandbox-when-an-object-is-in-an-array-or-an-argument-list...
CVE-2018-14773: Remove support for legacy and risky HTTP headers
More info at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers...
XSS vulnerability on asset view
Impact Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. Patch...
XSS vulnerability on password reset page
Impact For Mautic versions prior to 3.3.4, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password...
Information disclosure in the back end
More info at https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html...
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002
More info at https://www.drupal.org/sa-core-2021-002...
RCE vulnerability in "cookie" session driver
More info at https://blog.laravel.com/laravel-cookie-security-releases...
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
More info at https://symfony.com/cve-2019-10912...
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page Vulnerability Overview The Laravel framework versions between 11.9.0 and 11.35.1 are susceptible to reflected cross-site scripting due to an improper encoding of request parameters in the debug-mode error page. Identifier :...
phpseclib a large prime can cause a denial of service
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2528-jw5q-ww88. This link is maintained to preserve external references. Original Description An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. An attacker can...
Observable Response Discrepancy on Admin Login
Description Impact It allows over the Admin Login form to detect which user username, email exists and which one do not exist. Impacted by this issue are Sulu installation = 2.5.0 and getMessage; instead the $exception-getMessageKey; References Currently no references...
TYPO3-EXT-SA-2023-003: Cross-Site Scripting in extension "Fluid Components" (fluid_components)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-003...