1697 matches found
Moderately critical - Cross Site Scripting - SA-CORE-2019-004
More info at https://www.drupal.org/SA-CORE-2019-004...
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
More info at https://www.drupal.org/sa-core-2019-012...
Cookie serialization vulnerability
More info at https://laravel.com/docs/5.6/upgradeupgrade-5.6.30...
PHP Code Injection
phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
More info at https://symfony.com/blog/cve-2024-51755-unguarded-calls-to-isset-and-to-array-accesses-in-a-sandbox...
CVE-2024-50341: Security::login does not take into account custom user_checker
More info at https://symfony.com/cve-2024-50341...
Denial of Service via "MadeYouReset" vulnerability
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506. In versions 3.4.4 and 2.1.10, stream reset protection ha...
Key Commitment Issues in S3 Encryption Clients
More info at https://aws.amazon.com/security/security-bulletins/AWS-2025-032/...
TYPO3-EXT-SA-2025-005: Cross-Site Scripting in extension "[clickstorm] SEO" (cs_seo)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-005...
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-001...
Insecure HTTPS Connections due to Missing Default Certificate Validation
More info at https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb...
TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-002...
CVE-2022-37421 - Stored XSS in custom meta tags
More info at https://www.silverstripe.org/download/security-releases/cve-2022-37421...
Vulnerability which allows remote image dimensions check to be used to SSRF
More info at https://www.phpbb.com/community/viewtopic.php?f=14&t=2562636...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
PRODSECBUG-2342: Cross-Site Scripting mitigation bypass
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2412: Cross-Site Scripting via Location Name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2462: Remote code execution via file upload in admin import feature
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2475: Remote Code Execution through Cross-Site Request Forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2484: Arbitrary file deletion through export data data transfer
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2456: Broken authentication and session managememt
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2470: Remote Code Execution in email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2019-12617: Access escalation for CMS users with limited access through permission cache pollution
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12617/...
Circumvents open_basedir INI directive
ADVISORY: This release circumvents openbasedir in the requestinithook. If you rely on the openbasedir INI directive, we highly recommended you upgrade to 0.30.2. Fixed Shutdown span flushing blocking the process when forked 493 Memory access errors in cases when PHP code was run after extension...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
PRODSECBUG-2321: Filter extension bypass via crafted store configuration keys
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2128: Stored Cross Site Scripting in the Admin Panel through the tax/notification/info_url setting
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2307: Insufficient enforcement of user access controls can lead to unauthorized environment configuration changes
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2316: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2220: Deletion of store design schedule via cross-site request forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2186: Insecure Direct Object Reference (IDOR) vulnerability can expose order details
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2194: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
CVE-2018-11408: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2018-11408...
Language fallback can be incorrect on multilingual sites with node access restrictions.
More info at https://www.drupal.org/SA-CORE-2018-001...
Arbitrary shell execution
Security Advisory - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrad...
SS-2016-016: XSS In CMSSecurity BackURL
More info at https://www.silverstripe.org/download/security-releases/ss-2016-016/...
Incorrect cache context on password reset page
More info at https://www.drupal.org/SA-CORE-2016-005...
Cross-site Scripting in http exceptions
More info at https://www.drupal.org/SA-CORE-2016-004...
Users without "Administer comments" can set comment visibility on nodes they can edit
More info at https://www.drupal.org/SA-CORE-2016-004...
Cache Flooding in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-022...
Unauthenticated Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1918.html...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Potential XSS and Open Redirect vectors in zend-diactoros
More info at https://framework.zend.com/security/advisory/ZF2015-05...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...