1717 matches found
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Cross-Site Scripting in Language Pack Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...
Cross-Site Scripting in Fluid ViewHelpers
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...
SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector
More info at https://www.silverstripe.org/download/security-releases/ss-2018-020/...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
Action case insensitivity
Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
SS-2018-012: Uploaded PHP script execution in assets
More info at https://www.silverstripe.org/download/security-releases/ss-2018-012/...
SS-2018-013: Passwords sent back to browsers under some circumstances
More info at https://www.silverstripe.org/download/security-releases/ss-2018-013/...
SS-2018-008: BackURL validation bypass with malformed URLs
More info at https://www.silverstripe.org/download/security-releases/ss-2018-008/...
Incorrect header injection check
Security: Reject header injections correctly, see 4...
Invalid token creation and validation
More info at https://simplesamlphp.org/security/201708-01...
SS-2017-004: XSS in page history comparison
More info at https://www.silverstripe.org/download/security-releases/ss-2017-004/...
Flow Bugfix Releases for Entity Security
More info at https://www.neos.io/blog/flow-bugfix-releases-for-entity-security.html...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
ImageMagick driver does not escape all shell arguments.
More info at https://fuelphp.com/security-advisories...
ImageMagick driver does not escape all shell arguments.
More info at https://fuelphp.com/security-advisories...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...
Denial of Service attack possibility in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-008/...
SS-2015-028: Missing security check on dev/build/defaults
More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...
Cross-Site Scripting in legacy form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-003/...
Multiple Cross-Site Scripting vulnerabilities in frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/...
Cross-Site Scripting in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...
Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
More info at https://framework.zend.com/security/advisory/ZF2015-08...
SS-2015-017: Forum Module CSRF Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-017/...
SS-2015-015: XSS in dev/build returnURL Parameter
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-015/...
State guessing vulnerability
By doing this we're protecting against people trying to guess the state...
SS-2015-011: Potential SQL Injection Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
Privilege Escalation in TYPO3 Neos
More info at https://www.neos.io/blog/neos-sa-2015-001.html...
SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled
More info at https://www.silverstripe.org/download/security-releases/ss-2016-014/...
SS-2016-008: Password encryption salt expiry
More info at https://www.silverstripe.org/download/security-releases/ss-2016-008/...
SS-2016-012: Missing ACL on reports
More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...
SS-2015-008: SiteTree Creation Permission Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-008-sitetree-creation-permission-vulnerability/...
SS-2015-005: VirtualPage XSS
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-005/...
SS-2015-004: TreeDropdownField and TreeMultiSelectField XSS
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-004/...
Header injection in NativeMailerHandler
Hopefully attacker controlled data is never used to set the encoding or content type, but just in case, prevent: $nmh = new NativeMailerHandler$to, $subject, $from; $nmh-setEncoding "utf-8\r\nFrom: [email protected]"; Since the injection happened in send, there doesn't seem to be a good way to a...