1802 matches found
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Direct access of prefixed controller actions
More info at https://bakery.cakephp.org/2015/08/06/cakephp2592610272released.html...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
Denial of Service in OpenID System Extension
More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...
PHP Code Injection
phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
Laravel CRLF injection in default email rule
Summary A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied...
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
More info at https://symfony.com/blog/cve-2026-48807-sandbox-tostring-policy-bypass-via-traversable-in-join-replace-and-in-not-in-operators...
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
More info at https://symfony.com/cve-2024-50343...
CVE-2026-48761: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content
More info at https://symfony.com/cve-2026-48761...
Incorrect Ed25519 public key validation
!NOTE The fix was released in v2.5.1 Reported by Arpit Jain @arpitjain099 via email. This validation gate misfires, allowing invalid public keys to be loaded. Full advisory: https://github.com/paragonie/sodiumcompat/security/advisories/GHSA-733q-f2wq-9c8w The actual downstream impact is minimal i...
CVE-2026-54721 - Remote code execution via userforms email subject
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54721...
CVE-2026-54717 - XSS in breadcrumbs in page list view
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54717...
CRLF injection in HTTP start-line serialization
Impact guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: the request method, protocol version, and response reason phrase. If an application placed attacker-controlled data into one of those fields and later serialized the PSR-7 message as raw HTTP/1.x...
TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-019...
TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-013...
TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-012...
TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...
TYPO3-CORE-SA-2026-006: TYPO3 HTML Sanitizer allows Cross-Site Scripting
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-006...
Host confusion via authority reinterpretation
Impact guzzlehttp/psr7 improperly interpreted malformed Host header values when constructing request URIs from inbound request data. This issue concerns inbound request parsing and server request construction. It does not require serializing a PSR-7 request, and it is not part of the normal...
CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
More info at https://symfony.com/cve-2026-45075...
`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
More info at https://symfony.com/cve-2026-46634...
TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...
TYPO3-EXT-SA-2026-008: Remote Code Execution in extension "Site Crawler" (crawler)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-008...
Remote code execution via evaluation of user-controlled input in validation rules
Impact A remote code execution RCE vulnerability affects versions 0.13.2 through 0.13.21. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of...
Missing check that a point is on the prime subgroup for Edwards25519
More info at https://00f.net/2025/12/30/libsodium-vulnerability...
SS-2024-002 - Reflected Cross Site Scripting (XSS) in error message
More info at https://www.silverstripe.org/download/security-releases/ss-2024-002...
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
More info at https://symfony.com/cve-2021-21424...
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
More info at https://symfony.com/cve-2021-21424...
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...
CVE-2018-11406: CSRF Token Fixation
More info at https://symfony.com/cve-2018-11406...
Incorrect signature validation
More info at https://simplesamlphp.org/security/201803-01...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
Remote Code Execution
$highlight = Pygmentize::highlight'?php phpinfo;', ';uname -a '; printr$highlight; This will produce the following output: Darwin Micheals-MBP 16.1.0 Darwin Kernel Version 16.1.0: Thu Oct 13 21:26:57 PDT 2016; root:xnu-3789.21.360/RELEASEX8664 x8664 The problem lines appear to be here:...
Editor module incorrectly checks access to inline private files
More info at https://www.drupal.org/SA-2017-001...
Arbitrary shell execution
Security Advisory - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for...
Denial of service via transliterate mechanism
More info at https://www.drupal.org/SA-CORE-2016-005...
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
More info at https://symfony.com/cve-2015-8125...
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
More info at https://symfony.com/cve-2015-8125...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Unsafe methods in the Request class
More info at https://symfony.com/cve-2015-2309...
Anonymous authentication in ldap_bind() function of PHP, using null byte
More info at https://framework.zend.com/security/advisory/ZF2014-05...
XSS vulnerability exploitable on Internet Explorer
More info at http://htmlpurifier.org/news/2010/0531-4.1.1-released...