1717 matches found
Authentication bypass via attacker provided openid server
Description Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server. Patches This vulnerability only affects the outdated v1.x versions of the package. These a...
Padding Oracle Vulnerability in RSA Encryption
Hi, https://github.com/pagarme/pagarme-php/blob/master/lib/Pagarme/CardHashCommon.php This class has a confusing name. CardHash implies a cryptographic hash e.g. SHA256 is being used, but you're encrypting with RSA. Interestingly, you're not specifying the padding client-side, so you're encryptin...
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-009...
Microweber Business Logic Errors
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-6566...
Improper Input Validation in headers
Impact Improper header parsing. An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. Patches The issue is patched in 1.6.1. Workarounds Ther...
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2022-018...
TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-007...
TYPO3-CORE-SA-2022-002: Information Disclosure via Exception Handling/Logger
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-002...
Failure to strip the Cookie header on change in host or HTTP downgrade
Impact Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward...
CVE-2021-36150 - Insert from files link text - Reflective (self) Cross Site Scripting
More info at https://www.silverstripe.org/download/security-releases/CVE-2021-36150...
CVE-2021-25817 XXE: Vulnerability in CSSContentParser
More info at https://www.silverstripe.org/download/security-releases/cve-2021-25817...
Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial
URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system. Impact - The impact to Composer users directly is limit...
TYPO3-CORE-SA-2021-008: Cross-Site Scripting in Content Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-008...
TYPO3-CORE-SA-2020-005: Insecure Deserialization in Backend User Settings
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-005...
TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-002...
makeCollapsible allows applying event handler to any CSS selector
More info at https://phabricator.wikimedia.org/T246602...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
Exposed suppressed username via Special:Redirect
More info at https://phabricator.wikimedia.org/T230402...
PRODSECBUG-2172: Insecure user credential storage
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2245: Stored cross-site scripting in store shipping methods configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2322: Arbitrary code execution due to unsafe handling of a shipping gateway
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
Sandbox Information Disclosure
More info at https://symfony.com/blog/twig-sandbox-information-disclosure...
CVE-2019-5715: Reflected SQL Injection through Form and DataObject
More info at https://www.silverstripe.org/download/security-releases/ss-2018-021...
Potential RCE if filename starts with phar://
More info at https://pear.php.net/bugs/bug.php?id=23782...
Cross-Site Scripting in CKEditor
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-005...
Trusted-Directory Bypass via Path Traversal
if you enable secrity .$trusteddir is an array of all directories that are considered trusted. Trusted directories are where you keep php scripts that are executed directly from the templates . the attackers can use ../ to bypass the dir ,if they can editing the templates, they read any file they...
Information disclosure of source code
More info at https://simplesamlphp.org/security/202004-01...
External link injection on 404 pages when linking to the current page.
More info at https://www.drupal.org/SA-CORE-2018-001...
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...
Signature validation bypass (SAML 1.1)
More info at https://simplesamlphp.org/security/201710-01...
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
More info at https://contao.org/en/news/contao-3528.html...
Incorrect IV generation for encryption
More info at https://simplesamlphp.org/security/201703-02...
Some admin paths were not protected with a CSRF token
More info at https://www.drupal.org/SA-2017-001...
Incorrect signature verification
More info at https://simplesamlphp.org/security/201612-01...
Full config export can be downloaded without administrative permissions
More info at https://www.drupal.org/SA-CORE-2016-004...
HTTP Proxy header vulnerability
Bug Fixes - Removed support for using HTTPPROXY environment variable for non-CLI apps per CVE-2016-5385 httpoxy. Graham Campbell 143 145 - Convert BUGSNAGNOTIFYRELEASESTAGES to a comma-delimited array Jason Graham Campbell 142 144...
Information leakage issue in the sanitycheck module
More info at https://simplesamlphp.org/security/201603-01...
Open redirect via path manipulation
More info at https://www.drupal.org/SA-CORE-2016-001...
Brute force amplification attacks via XML-RPC
More info at https://www.drupal.org/SA-CORE-2016-001...
Remote code execution in templates
More info at https://symfony.com/blog/security-release-twig-1-20-0...
A directory traversal vulnerability allows back end users to view files outside their document root
More info at https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html...
Possible Host Spoofing through SERVER_NAME
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/...
Validation metadata serialization and loss of information
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
CVE-2019-10910: Check service IDs are valid
More info at https://symfony.com/cve-2019-10910...
CVE-2019-10911: Add a separator in the remember me cookie hash
More info at https://symfony.com/cve-2019-10911...
Moderately critical - Cross Site Scripting - SA-CORE-2019-004
More info at https://www.drupal.org/SA-CORE-2019-004...
CVE-2020-15245: Ability to switch customer email address on account detail page and stay verified
Impact The user may register in a shop by email [email protected], verify it, change it to the mail [email protected] and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any...
TOTP throttle not enforced cross-wiki
More info at https://phabricator.wikimedia.org/T251661...
Possible cross-site scripting (XSS) vulnerability in the Blade templating engine
A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine. Given the following two Blade templates: resources/views/parent.blade.php: html @section'content' @show resources/views/child.blade.php: html @extends'parent' @section'content' @endsection And a route...