Lucene search
+L
FriendsofphpMost viewed

1769 matches found

Friends Of PHP
Friends Of PHP
•added 2023/03/28 7:41 p.m.•35 views

Cross site scripting vulnerability in Javascript escaping

Impact An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the...

7.1CVSS7AI score0.01025EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2023/02/01 8:00 a.m.•35 views

CVE-2022-24895: Possible CSRF token fixation

More info at https://symfony.com/cve-2022-24895...

8.8CVSS7.2AI score0.0079EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/12/13 9:19 a.m.•35 views

TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-014...

5.4CVSS7.2AI score0.004EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/12/13 9:18 a.m.•35 views

TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-012...

7.5CVSS7.2AI score0.00686EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/09/13 8:07 a.m.•35 views

TYPO3-CORE-SA-2022-011: By-passing Cross-Site Scripting Protection in HTML Sanitizer

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-011...

6.1CVSS7.2AI score0.00818EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/09/13 8:06 a.m.•35 views

TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-008...

5.4CVSS7.2AI score0.0095EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/06/27 5:27 a.m.•35 views

CVE-2022-25238: Stored XSS via HTML fields

More info at https://www.silverstripe.org/download/security-releases/cve-2022-25238...

5.4CVSS7.2AI score0.0067EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/06/14 7:11 a.m.•35 views

TYPO3-CORE-SA-2022-004: Cross-Site Scripting in Frontend Login Mailer

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-004...

5.4CVSS7.2AI score0.00755EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/06/09 9:36 p.m.•35 views

Fix failure to strip Authorization header on HTTP downgrade

Impact Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the heade...

7.5CVSS7.4AI score0.01914EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/03/17 4:15 p.m.•35 views

Path manipulation

Description matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. The issue was fixed in version 3.0.6. References https://nvd.nist.gov/vuln/detail/CVE-2021-43676 https://github.com/matyhtf/framework/issues/206 matyhtf/framework@2508460...

7.5CVSS1.7AI score0.01381EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 2022/02/23 4:04 p.m.•35 views

Multi-Factor Authentication issue in Laravel Fortify

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept...

8.1CVSS8AI score0.00946EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2021/03/16 9:01 a.m.•35 views

TYPO3-CORE-SA-2021-007: Cross-Site Scripting in Content Preview

More info at https://typo3.org/security/advisory/typo3-core-sa-2021-007...

5.4CVSS5.8AI score0.00872EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2021/01/24 10:13 p.m.•35 views

template_object Sandbox Escape PHP Code Injection

More info at https://srcincite.io/blog/2021/02/18/smarty-template-engine-multiple-sandbox-escape-vulnerabilities.html...

7.5CVSS7.2AI score0.09436EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 2020/11/17 8:50 a.m.•35 views

TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier

More info at https://typo3.org/security/advisory/typo3-core-sa-2020-011...

8.1CVSS7.2AI score0.00675EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2020/09/21 4:46 p.m.•35 views

Special:UserRights exposes the existence of hidden users

More info at https://phabricator.wikimedia.org/T232568...

5.3CVSS7.2AI score0.01291EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2020/07/10 3:03 p.m.•35 views

CVE-2020-6164: Information disclosure on /interactive URL path

More info at https://www.silverstripe.org/download/security-releases/cve-2020-6164/...

7.5CVSS7.2AI score0.018EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/10/08 12:00 a.m.•35 views

PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

5.3CVSS7.2AI score0.00811EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/10/08 12:00 a.m.•35 views

PRODSECBUG-2425: Cross-Site Scripting via Signifyd Guarantee Option Translation Override

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

5.4CVSS7.2AI score0.00556EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/10/08 12:00 a.m.•36 views

PRODSECBUG-2478: Broken authentication and session managememt

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

6.5CVSS7.2AI score0.01168EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/10/08 12:00 a.m.•35 views

PRODSECBUG-2419: Bypass of sitemp access restrictions

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

6.5CVSS7.2AI score0.00992EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/10/08 12:00 a.m.•35 views

PRODSECBUG-2410: Cross-Site Scripting via Dynamic block in the Page builder

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

5.4CVSS7.2AI score0.00556EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/06/25 6:39 a.m.•35 views

Insecure Deserialization in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...

8.8CVSS7.2AI score0.01554EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/06/25 12:00 a.m.•35 views

PRODSECBUG-2337: Stored cross-site scripting in the catalog templates form

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

5.4CVSS7.2AI score0.00566EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/06/25 12:00 a.m.•35 views

PRODSECBUG-2190: Stored cross-site scripting in the admin panel

More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...

4.8CVSS7.2AI score0.00557EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/05/30 8:55 p.m.•35 views

Exposed suppressed username or log in Special:EditTags

More info at https://phabricator.wikimedia.org/T222036...

6.5CVSS7.2AI score0.0141EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2019/04/09 12:21 p.m.•35 views

Confirming an opt-in token does not invalidate previous opt-in tokens

More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...

9.8CVSS7.2AI score0.01254EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2018/05/25 11:46 a.m.•35 views

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

8.1CVSS7.2AI score0.01988EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2018/04/26 7:38 p.m.•35 views

Trusted-Directory Bypass via Path Traversal

Smarty Trusted-Directory Bypass via Path Traversal\nVulnerability Overview\nSmarty 3.1.32 or below is prone to a path traversal vulnerability due\nto insufficient sanitization of code in Smarty templates. This allows\nattackers controlling the Smarty template to bypass the trusted\ndirectory...

5CVSS6.8AI score0.03463EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 2018/02/20 9:35 p.m.•35 views

JavaScript cross-site scripting prevention is incomplete.

More info at https://www.drupal.org/SA-CORE-2018-001...

6.1CVSS7.2AI score0.01613EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2018/02/20 9:35 p.m.•35 views

jQuery vulnerability with untrusted domains.

More info at https://www.drupal.org/SA-CORE-2018-001...

6.1CVSS7.2AI score0.01224EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2017/11/15 8:53 a.m.•35 views

SQL injection vulnerabililty in the front end listing module

More info at https://contao.org/en/news/contao-448.html...

9.8CVSS7.2AI score0.01178EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2017/11/15 8:51 a.m.•35 views

SQL injection vulnerabililty in the back end search filter

More info at https://contao.org/en/news/contao-448.html...

9.8CVSS7.2AI score0.01178EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2017/08/16 5:10 p.m.•35 views

REST API can bypass comment approval.

More info at https://www.drupal.org/SA-CORE-2017-004...

7.4CVSS7.2AI score0.02102EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2017/03/17 9:34 a.m.•35 views

Multiple timing side-channel issues

More info at https://simplesamlphp.org/security/201703-01...

5.9CVSS7.2AI score0.01447EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2016/07/18 4:01 p.m.•35 views

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003

More info at https://www.drupal.org/SA-CORE-2016-003...

8.1CVSS9.7AI score0.50427EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2016/07/15 5:44 p.m.•35 views

HTTP Proxy header vulnerability

Addressing HTTPPROXY security vulnerability, CVE-2016-5385: https://httpoxy.org/. Please update to this version of Guzzle in order to mitigate the vulnerability when sending Guzzle requests inside of a CGI application. - Fixing timeout bug with StreamHandler - Only read up to Content-Length in...

8.1CVSS6.7AI score0.50427EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2016/01/14 9:48 a.m.•35 views

CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails

More info at https://symfony.com/cve-2016-1902...

7.5CVSS7.2AI score0.01907EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2016/01/06 9:35 p.m.•35 views

Local File Disclosure

SECURITY Fix CVE-2017-5223, local file disclosure vulnerability if content passed to msgHTML is sourced from unfiltered user input. Reported by Yongxiang Li of Asiasecurity. The fix for this means that calls to msgHTML without a $basedir will not import images with relative URLs, and relative...

5.5CVSS6.5AI score0.02161EPSS
SaveExploits6Affected Software1
Friends Of PHP
Friends Of PHP
•added 2015/08/03 3:13 p.m.•35 views

XXE/XEE vector when using ZendXml on multibyte payloads

More info at https://framework.zend.com/security/advisory/ZF2015-06...

6.8CVSS9.7AI score0.09911EPSS
SaveExploits7Affected Software1
Friends Of PHP
Friends Of PHP
•added 2014/09/03 7:40 a.m.•35 views

Direct access of ESI URLs behind a trusted proxy

More info at https://symfony.com/cve-2014-5245...

7.2AI score0.00812EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2014/09/03 7:37 a.m.•35 views

Denial of service with a malicious HTTP Host header

More info at https://symfony.com/cve-2014-5244...

7.2AI score0.01663EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2014/05/22 9:33 a.m.•35 views

Information disclosure in the Extbase framework

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/...

4CVSS7.2AI score0.01118EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 2014/02/26 10:13 p.m.•35 views

XEE issue that could expose local files or easily trigger a DOS attack.

XXE security issue. Issue 414...

7.5CVSS6.1AI score0.02228EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

More info at https://www.drupal.org/sa-core-2020-007...

6.1CVSS7.2AI score0.02925EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...

9.8CVSS7AI score0.26172EPSS
SaveExploits7Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

CVE-2018-14773: Remove support for legacy and risky HTTP headers

More info at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers...

6.5CVSS7.2AI score0.58061EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

Deserialization of Untrusted Data

Description This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation. References...

10CVSS9.1AI score0.02714EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

Denial of Service via HTTP/2 CONTINUATION Frames

amphp/http will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the ENDHEADERS flag, resulting in an OOM crash. amphp/http-client and amphp/http-server are indirectly affected if they're used with an unpatched version of...

8.2CVSS7.8AI score0.83366EPSS
SaveExploits1Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

PHP file inclusion via insert tags

More info at https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html...

7.2CVSS7.2AI score0.01254EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
•added 1970/01/01 12:00 a.m.•35 views

Critical - Remote Code Execution

More info at https://www.drupal.org/sa-core-2018-004...

9.8CVSS7.2AI score0.99236EPSS
SaveExploits14Affected Software1
Total number of security vulnerabilities1769