1717 matches found
Arbitrary file read in dompdf
More info at https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/...
Local file exposure on Windows installations
More info at https://groups.google.com/forum/?fromgroups=!topic/sabredav-discuss/ehOUu7wTSGQ...
Drupal core - Less critical - Access bypass - SA-CORE-2020-006
More info at https://www.drupal.org/sa-core-2020-006...
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
More info at https://symfony.com/cve-2019-10912...
PHP Code Injection
phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...
Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
More info at https://www.drupal.org/sa-core-2020-004...
Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
More info at https://www.drupal.org/sa-core-2020-004...
Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
More info at https://www.drupal.org/sa-core-2020-008...
Cross site scripting via HTML attributes in the back end
More info at https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end.html...
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002
More info at https://www.drupal.org/sa-core-2021-002...
Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011
More info at https://www.drupal.org/sa-core-2020-011...
XSS vulnerability on contacts view
Impact Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populat...
symfony/ux-autocomplete Information exposure via unescaped LIKE wildcards in EntitySearchUtil
Description Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping the SQL LIKE wildcards %, , . The value is passed as a bound parameter, so this is not SQL...
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-001...
Possible sandbox bypass
More info at https://symfony.com/blog/twig-security-release-possible-sandbox-bypass...
TYPO3-EXT-SA-2023-010: Broken Access Control in extension "femanager" (femanager)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-010...
TYPO3-EXT-SA-2023-009: Insecure Direct Object Reference in extension "Content Consent" (content_consent)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-009...
TYPO3-EXT-SA-2023-008: Broken Access Control in extension "femanager" (femanager)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-008...
Possible RCE when rendering untrusted user templates
Fix CVE-2022-0323, possible RCE when rendering untrusted user templates, reported by @altm4n via huntr.dev - Improve compatibility with PHP 8.1...
CVE-2022-37429 - Stored XSS using HTMLEditor
More info at https://www.silverstripe.org/download/security-releases/cve-2022-37429...
Unescaped message used in HTML within LogEventsList
More info at https://phabricator.wikimedia.org/T256171...
TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-006...
CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
More info at https://symfony.com/cve-2020-5255...
CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
More info at https://symfony.com/cve-2020-5255...
Possible to circumvent title-blacklist
More info at https://phabricator.wikimedia.org/T239466...
CVE-2019-12246: Denial of Service on flush and development URL tools
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12246...
Exposed suppressed log in RevisionDelete page
More info at https://phabricator.wikimedia.org/T222038...
Forbid blocking IP ranges as big as /1 and /2, as done on ruwikiquote using the API
More info at https://phabricator.wikimedia.org/T199540...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2019-007...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. - js:core Fixed 2863 cssAutoLoad Array option is not working - js:core Fixed 2862 stop autoSync when browser tab turn to background - cmd:search Fixed 2867 support incremental search other than filename - VD:abstract Fixed 2873 correct...
The CSRF token check can be bypassed
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10642.html...
$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
More info at https://phabricator.wikimedia.org/T169545...
$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
More info at https://phabricator.wikimedia.org/T169545...
CVE-2018-11385: Session Fixation Issue for Guard Authentication
More info at https://symfony.com/cve-2018-11385...
Cross Site Scripting (XSS) in the consentAdmin module
More info at https://simplesamlphp.org/security/201709-01...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
CVE-2017-11365: Empty passwords validation issue
More info at https://symfony.com/cve-2017-11365...
PECL YAML parser unsafe object handling
More info at https://www.drupal.org/SA-CORE-2017-003...
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
More info at https://www.drupal.org/SA-CORE-2017-003...
Remote code execution
More info at https://www.drupal.org/SA-2017-001...
Arbitrary shell execution
Security Advisory This release contains a fix for a security advisory related to the improper handling of shell commands Uses of shellexec and exec were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary co...
Session data truncation can lead to unserialization of user provided data
More info at https://www.drupal.org/SA-CORE-2016-001...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
XSS vulnerability in login redirect param
Security advisory: XSS vulnerability in login redirect param ZfcUser version 1.2.2 has been released and includes a security for this vulnerability. Fix has been applied in @baf0e460 Affected versions All versions below 1.2.2 are affected. dev-master is fixed starting from @2cc167a Exploits Becau...
Anonymous authentication in ldap_bind() function of PHP, using null byte
More info at https://framework.zend.com/security/advisory/ZF2014-05...