1717 matches found
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
More info at https://symfony.com/cve-2026-48489...
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
More info at https://symfony.com/cve-2019-18888...
symfony/ux-autocomplete XSS via unescaped AJAX response data
Description The Stimulus controller shipped with symfony/ux-autocomplete renders AJAX response items into the dropdown by interpolating the text field directly into HTML template literals $itemlabelField inside createAutocompleteWithRemoteData. The value is parsed as HTML rather than text, so any...
Key Commitment Issues in S3 Encryption Clients
More info at https://aws.amazon.com/security/security-bulletins/AWS-2025-032/...
CVE-2022-29858: Unpublished, protected files can be published via shortcode
More info at https://www.silverstripe.org/download/security-releases/cve-2022-29858...
Cross site scripting via canonical URL
More info at https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html...
CVE-2022-38146 - URL XSS vulnerability due to outdated jquery in CMS
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38146...
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
More info at https://symfony.com/cve-2021-41267...
TYPO3-CORE-SA-2021-011: Cross-Site Scripting in Backend Grid View
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-011...
TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-009...
TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-009...
Improper Certificate Validation in phpseclib
More info at https://github.com/phpseclib/phpseclib/pull/1635...
TYPO3-CORE-SA-2021-006: Cleartext storage of session identifier
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-006...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2020-9280: Folders migrated from 3.x may be unsafe to upload to
More info at https://www.silverstripe.org/download/security-releases/cve-2020-9280/...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-015...
PRODSECBUG-2267: Use of insufficiently random values when generating initialization vector
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2226: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2320: Arbitrary code execution due to unsafe handling of system configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2298: Arbitrary code execution through product imports and design layout update
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
CVE-2019-1000011: Access control bypass in GraphQL mutations
| Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | 2364 | License | MIT | Doc PR | This prevents passing IRIs belonging to different resource classes, which would bypass access control in some instances s...
CVE-2018-19790: Open Redirect Vulnerability on login
More info at https://symfony.com/cve-2018-19790...
Loading JS from user space where the username is not a registered account is dangerous and should be banned
More info at https://phabricator.wikimedia.org/T207603...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
Possibility of manipulated condition when unfiltered input is passed to `yii\elasticsearch\ActiveRecord::findOne()` and `::findAll()`
More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...
jQuery vulnerability with untrusted domains.
More info at https://www.drupal.org/SA-CORE-2018-001...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
Session fixation and authentication bypass (authcrypt module)
More info at https://simplesamlphp.org/security/201705-01...
Vulnerability to Response Wrapping attacks resulting in a malicious user gaining unauthorized access to a system.
Improve Signature validation process. Validates NameID only if strict is enabled...
Potential SQL injection in ORDER and GROUP statements of Zend_Db_Select
More info at https://framework.zend.com/security/advisory/ZF2016-02...
CVE-2016-4423: Large username storage in session
More info at https://symfony.com/cve-2016-4423...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via double-encoded 'destination' parameter
More info at https://www.drupal.org/SA-CORE-2016-001...
Composer Cache Injection vulnerability
More info at http://flyingmana.de/blogen/2016/02/14/composercacheinjectionvulnerabilitycve20158371.html...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
class yii\web\ViewAction allowed to include arbitrary files that end with .php
More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
Security issue when parsing the Authorization header
More info at https://symfony.com/cve-2014-6061...
Ability to enable/disable PHP parsing in Yaml::parse()
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
Multiple XSS vulnerabilities exploitable on Internet Explorer
More info at http://htmlpurifier.org/security/2010/css-quoting...
Possible cross-site scripting (XSS) vulnerability in the Blade templating engine
A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine. Given the following two Blade templates: resources/views/parent.blade.php: html @section'content' @show resources/views/child.blade.php: html @extends'parent' @section'content' @endsection And a route...
Privilege escalation with the form generator
More info at https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
Existing sessions are not correctly invalidated when a user changes their password
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10641.html...
Cross-site scripting (XSS) vulnerability in Paypal-Merchant-SDK-PHP
Hello: I have find a Reflected XSS vulnerability in this sdk. The vulnerability exists due to insufficient filtration of user-supplied data in “token” HTTP GET parameter that will be passed to “merchant-sdk-php\samples\AccountAuthentication\GetAuthDetails.html.php”. The infected source code is li...