1709 matches found
Denial Of Service Vector
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
More info at https://symfony.com/cve-2015-8125...
Multiple CRLF injection vulnerabilities
This release contains an important security update. Security update Takeshi Terada discovered that PHPMailer accepted addresses containing line breaks. This is valid in RFC5322, but allowing such addresses resulted in invalid RFC5321 SMTP commands, permitting a kind of message injection attack...
Potential XXE security issue
improved XXE fix CVE-2014-2053...
Validation metadata serialization and loss of information
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
Ability to enable/disable PHP parsing in Yaml::parse()
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
CVE-2019-18887: Use constant time comparison in UriSigner
More info at https://symfony.com/cve-2019-18887...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
Insecure Random Number Generator
Insecure RNG: stormpath-sdk-php/src/Util/UUID.php Lines 167 to 181 in 15aee30 / Generate an UUID version 4 pseudo random / static private function generateRandom$ns, $node $uuid = self::$muuidfield; $uuid'timehi' = 4 12 | mtrand0, 0x1000; $uuid'clockseqhi' = 1 7 | mtrand0, 128; $uuid'timelow' =...
Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
More info at https://www.drupal.org/sa-core-2020-008...
CVE-2019-18886: Prevent user enumeration using switch user functionality
More info at https://symfony.com/cve-2019-18886...
Moderately critical - Third-party libraries - SA-CORE-2019-007
More info at https://www.drupal.org/SA-CORE-2019-007...
Secret data exfiltration via symfony parameters
Impact Symfony parameters which is what Mautic transforms configuration parameters into can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any ...
Password reset phishing vulnerability
More info at https://laravel.com/docs/5.4/releaseslaravel-5.4.22...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...
CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances
More info at https://symfony.com/cve-2019-18889...
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
More info at https://symfony.com/cve-2026-46644...
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-009...
TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2023-001...
TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...
CVE-2022-29858: Unpublished, protected files can be published via shortcode
More info at https://www.silverstripe.org/download/security-releases/cve-2022-29858...
TYPO3-CORE-SA-2022-005: Insufficient Session Expiration in Admin Tool
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-005...
Disallow non closures in the sort filter
More info at https://symfony.com/blog/twig-security-release-disallow-non-closures-in-the-sort-filter...
CVE-2021-41268: Remember me cookie persistance after password changes
More info at https://symfony.com/cve-2021-41268...
TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-009...
Improper Certificate Validation in WP-CLI framework
Description Impact An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including...
TYPO3-CORE-SA-2021-004: Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-004...
TYPO3-CORE-SA-2021-006: Cleartext storage of session identifier
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-006...
Cross-Site Scripting through Fluid view helper arguments
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-009...
TYPO3-CORE-SA-2020-008: Sensitive Information Disclosure
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-008...
CVE-2019-19326: Web Cache Poisoning through HTTPRequestBuilder
More info at https://www.silverstripe.org/download/security-releases/cve-2019-19326/...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2019-12204: Missing warning on install.php on public webroot can lead to unauthenticated admin access
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12204/...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-015...
PRODSECBUG-2387: Cross site request forgery attacks are possible via the gift card removal feature
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2320: Arbitrary code execution due to unsafe handling of system configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2208: Insufficient authorization check when adding users to company accounts
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
CVE-2019-12149: Potential SQL injection in restfulserver and registry modules
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12149...
Unsafe deserialization in SmtpTransport
More info at https://bakery.cakephp.org/2019/04/23/cakephp37736153518released.html...
CVE-2018-19789: Temporary uploaded file path disclosure
More info at https://symfony.com/cve-2018-19789...
Potential enwiki DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
More info at https://phabricator.wikimedia.org/T204729...
Incorrect signature validation
More info at https://simplesamlphp.org/security/201802-01...
Private file access bypass.
More info at https://www.drupal.org/SA-CORE-2018-001...
Language fallback can be incorrect on multilingual sites with node access restrictions.
More info at https://www.drupal.org/SA-CORE-2018-001...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
Denial of Service in timestamp validation function
More info at https://simplesamlphp.org/security/201801-01...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...