1773 matches found
XML injection via CDATA terminator in XML request serialization
Impact guzzlehttp/guzzle-services does not safely serialize scalar XML element values containing the CDATA terminator . The XML request serializer writes values containing , or & with XMLWriter::writeCData$value. If attacker-controlled input contains , the CDATA section closes early and the...
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
More info at https://symfony.com/cve-2026-48736...
Possible SQL injection in widget field value
Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...
Read private customer data reclaiming carts
Klaviyo read customer quotes for guest carts April 28th I've found a endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API. Data -...
EZSA-2020-005 Editor XSS and trashed drafts in review queue
More info at https://ezplatform.com/security-advisories/ezsa-2020-005-editor-xss-and-trashed-drafts-in-review-queue...
EZSA-2020-003 XSS in DemoBundle/ezdemo bundled VideoJS
More info at https://ezplatform.com/security-advisories/ezsa-2020-003-xss-in-demobundle-ezdemo-bundled-videojs...
XSS vulnerability in blade templating
More info at https://github.com/laravel/framework/pull/31945...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
EZSA-2019-006 Rules to disable executable access are ignored on Platform.sh (eZ Cloud)
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-006-rules-to-disable-executable-access-are-ignored-on-platform.sh-ez-cloud...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Information disclosure
More info at https://framework.zend.com/security/advisory/ZF2019-01...
Cross-Site Scripting in Fluid ViewHelpers
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
Action case insensitivity
Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
Potential SQL injection vector
The SelectLimit function has a potential SQLi exploit through the use of the nrows and offset parameters which are not forced to integers. Fixes 400...
SQL injection possible with limit() on MySQL
The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: php UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...
Non-Persistent XSS
More info at https://community.shopware.com/detail2048.html...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-005/...
Invalid token creation and validation
More info at https://simplesamlphp.org/security/201708-01...
SS-2017-004: XSS in page history comparison
More info at https://www.silverstripe.org/download/security-releases/ss-2017-004/...
Local File Inclusion Vulnerability
More info at https://hackerone.com/reports/179034...
Potential SQL injection in ORDER and GROUP functions of ZF1
More info at https://framework.zend.com/security/advisory/ZF2016-03...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-021...
Link injection
More info at https://simplesamlphp.org/security/201606-01...
XML External Entity (XXE) Processing in TYPO3 Core
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-005/...
Cross-Site Scripting in legacy form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-003/...
Potential Information Disclosure in Zend\Crypt\PublicKey\Rsa\PublicKey
More info at https://framework.zend.com/security/advisory/ZF2015-10...
Potential Information Disclosure in Zend\Crypt\PublicKey\Rsa\PublicKey
More info at https://framework.zend.com/security/advisory/ZF2015-10...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Attackers able to impersonate users
Merge branch 'disabling-none-by-default'...
Header injection in NativeMailerHandler
Hopefully attacker controlled data is never used to set the encoding or content type, but just in case, prevent: $nmh = new NativeMailerHandler$to, $subject, $from; $nmh-setEncoding "utf-8\r\nFrom: [email protected]"; Since the injection happened in send, there doesn't seem to be a good way to a...
Entropy is lost in the TokenGenerator
More info at https://symfony.com/blog/fosuserbundle-entropy-of-generated-tokens-is-lost...
Authentication adapter did not verify validity of tokens
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...
Hijacked authentication cookies vulnerability
More info at https://laravel.com/docs/5.3/upgradeupgrade-4.1.26...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Fixed issue with broken validation of JSONP callbacks
More info at https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler...
Security fixes related to the way XML is handled
More info at https://symfony.com/blog/security-release-symfony-2-0-17-released...
Insecure Unserialize Vulnerability in FLOW3
More info at https://www.neos.io/blog/flow-sa-2012-001.html...
Potential XSS vectors due to inconsistent encodings
More info at https://framework.zend.com/security/advisory/ZF2010-01...