1769 matches found
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
More info at https://symfony.com/cve-2019-10912...
RCE vulnerability in "cookie" session driver
More info at https://blog.laravel.com/laravel-cookie-security-releases...
RCE vulnerability in "cookie" session driver
More info at https://blog.laravel.com/laravel-cookie-security-releases...
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002
More info at https://www.drupal.org/sa-core-2021-002...
Critical - Arbitrary PHP code execution
More info at https://www.drupal.org/sa-core-2019-002...
Insert tag injection in front end forms
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html...
Microweber Business Logic Errors
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-6566...
CVE-2023-22728 - Missing permission check in GridFieldPrintButton
More info at https://www.silverstripe.org/download/security-releases/cve-2023-22728...
TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-013...
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
More info at https://www.drupal.org/sa-core-2022-014...
Inproper parsing of HTTP headers
Impact Improper header parsing. An attacker could sneak in a carriage return character \r and pass untrusted values in both the header names and values. Patches The issue is patched in 1.8.4 and 2.1.1. Workarounds There are no known workarounds. References...
CVE-2022-23601: CSRF token missing in forms
More info at https://symfony.com/cve-2022-23601...
CVE-2021-36150 - Insert from files link text - Reflective (self) Cross Site Scripting
More info at https://www.silverstripe.org/download/security-releases/CVE-2021-36150...
TYPO3-CORE-SA-2021-012: Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-012...
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
More info at https://symfony.com/cve-2021-21424...
Potential file overwrite if archive filename starts with file://
I have submitted this to the PEAR bug tracker as well as the PEAR group mailing list, and I'm not sure if either has gone through, so opening an issue here with the hope that this is the right place for it. While auditing a separate application which uses ArchiveTar internally, I found that...
Sensitive Information Disclosure in extension "Media Content Element" (mediace)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2020-014...
TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-002...
CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy
More info at https://symfony.com/cve-2020-5275...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
CVE-2019-12245: Incorrect access control vulnerability in files uploaded to protected folders
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12245/...
PRODSECBUG-2245: Stored cross-site scripting in store shipping methods configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2322: Arbitrary code execution due to unsafe handling of a shipping gateway
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
SUPEE-11086 - RCE, XSS, CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-11086...
CVE-2019-5715: Reflected SQL Injection through Form and DataObject
More info at https://www.silverstripe.org/download/security-releases/ss-2018-021...
CVE-2018-11406: CSRF Token Fixation
More info at https://symfony.com/cve-2018-11406...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-3535.html...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-4418.html...
Highly critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-002...
CVE-2017-16654: Intl bundle readers breaking out of paths
More info at https://symfony.com/cve-2017-16654...
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
More info at https://symfony.com/cve-2017-16653...
Unauthenticated encryption in CBC mode
More info at https://simplesamlphp.org/security/201704-01...
Incorrect IV generation for encryption
More info at https://simplesamlphp.org/security/201703-02...
Brute force amplification attacks via XML-RPC
More info at https://www.drupal.org/SA-CORE-2016-001...
CVE-2015-4050: ESI unauthorized access
More info at https://symfony.com/cve-2015-4050...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
A directory traversal vulnerability allows back end users to view files outside their document root
More info at https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html...
Security issue when parsing the Authorization header
More info at https://symfony.com/cve-2014-6061...
The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property
More info at https://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/...
Possible Host Spoofing through SERVER_NAME
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/...
Moderately critical - Cross Site Scripting - SA-CORE-2019-004
More info at https://www.drupal.org/SA-CORE-2019-004...
CVE-2019-10911: Add a separator in the remember me cookie hash
More info at https://symfony.com/cve-2019-10911...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
More info at https://www.silverstripe.org/download/security-releases/CVE-2023-48714...
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
More info at https://symfony.com/cve-2026-48489...
CVE-2019-12186: XSS injection in the Grid component
More info at https://sylius.com/blog/cve-2019-12186/...
Deserialization Gadget chain in Swift Mailer
Summary Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will enable remote code executio...