1802 matches found
TYPO3-EXT-SA-2025-003: Multiple vulnerabilities in extension “[clickstorm] SEO” (cs_seo)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-003...
SS-2024-002 - Reflected Cross Site Scripting (XSS) in error message
More info at https://www.silverstripe.org/download/security-releases/ss-2024-002...
Header leakage on cross-domain redirects
This version fixes a security weakness that might leak sensitive request headers from the initial request to the redirected host on cross-domain redirects, which were not removed correctly. Message::setHeaders does not replace the entire set of headers, but only operates on the headers matching t...
Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
More info at https://www.drupal.org/sa-core-2020-003...
PRODSECBUG-2367: Remote code execution due to unsafe handling of a carrier gateway
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Use of insecure connection charset (sqlauth module)
More info at https://simplesamlphp.org/security/201801-03...
An error during signature verification can be treated as a successful verification.
…nse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature algorithm used. The opensslverify function returns 1 when the signature...
Inconsistent name for term access query
More info at https://www.drupal.org/SA-CORE-2016-005...
Inconsistent name for term access query
More info at https://www.drupal.org/SA-CORE-2016-005...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
PHP object injection vulnerability allows for arbitrary code execution
More info at https://contao.org/en/news/major-security-hole-found-in-contao.html...
Vulnerability in the filesystem loader
More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...
XSS vulnerability exploitable on Internet Explorer
More info at http://htmlpurifier.org/news/2010/0531-4.1.1-released...
Filter input to avoid XPath injection
In order to avoid XPath injection, user input must be filtered before it ends up in the query. Unfortunately, there's no way to do this with a standard method in PHP, so we need our own filtering function. Current best practice recommends using white lists instead of black lists to allow only a...
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
More info at https://symfony.com/cve-2024-51996...
CVE-2026-45753: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite: javascript: URI Survives Sanitization (XSS)
More info at https://symfony.com/cve-2026-45753...
CVE-2024-50345: Open redirect via browser-sanitized URLs
More info at https://symfony.com/cve-2024-50345...
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
More info at https://www.drupal.org/sa-core-2019-012...
Cookie serialization vulnerability
More info at https://laravel.com/docs/5.6/upgradeupgrade-5.6.30...
Incorrect Ed25519 public key validation
!NOTE The fix was released in v2.5.1 Reported by Arpit Jain @arpitjain099 via email. This validation gate misfires, allowing invalid public keys to be loaded. Full advisory: https://github.com/paragonie/sodiumcompat/security/advisories/GHSA-733q-f2wq-9c8w The actual downstream impact is minimal i...
TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-020...
CVE-2026-54720 - XSS attack through media embed
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54720...
RSA1_5 (RSAES-PKCS1-v1_5) decryption lacks implicit rejection, exposing a Bleichenbacher/Marvin padding oracle
Impact RSACrypt::decryptWithRSA15 used by the RSA15 key-encryption algorithm implements RSAES-PKCS1-v15 decryption by inspecting the padding after RSADP and throwing InvalidArgumentException as soon as the padding is malformed. It does not implement the implicit-rejection countermeasure required ...
CRLF injection via URI host component
Impact guzzlehttp/psr7 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. The issue requires a PSR-7 request to be serialized into a raw HTTP/1.x message, for example with GuzzleHttp\Psr7\Message::toString or an equivalent custom serializer. Creating a...
SQL Injection in extension "News system" (news)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-010...
TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...
Insecure default secret key and IV allowing anyone to decrypt values
This issue has been deleted...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
Arbitrary Code Execution via File List Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-008...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
Action case insensitivity
Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...
CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
More info at https://symfony.com/cve-2018-11407...
CVE-2018-11408: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2018-11408...
CVE-2018-11408: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2018-11408...
Potential SQL injection vector
The SelectLimit function has a potential SQLi exploit through the use of the nrows and offset parameters which are not forced to integers. Fixes 400...
Language fallback can be incorrect on multilingual sites with node access restrictions.
More info at https://www.drupal.org/SA-CORE-2018-001...
Access bypass
More info at https://www.drupal.org/SA-2017-002...
Editor module incorrectly checks access to inline private files
More info at https://www.drupal.org/SA-2017-001...
Cross-site Scripting in http exceptions
More info at https://www.drupal.org/SA-CORE-2016-004...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Local file exposure on Windows installations
More info at https://groups.google.com/forum/?fromgroups=!topic/sabredav-discuss/ehOUu7wTSGQ...
Prevent installation typosquatting malware
More info at https://www.kernelmode.blog/typosquatting-malware-found-in-composer-repository/...