1802 matches found
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
EZSA-2019-006 Rules to disable executable access are ignored on Platform.sh (eZ Cloud)
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-006-rules-to-disable-executable-access-are-ignored-on-platform.sh-ez-cloud...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Information disclosure
More info at https://framework.zend.com/security/advisory/ZF2019-01...
Retrieval of HTTP-only cookies
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
Broken Access Control in Localization Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...
Credentials exposure in session storage
More info at https://simplesamlphp.org/security/201812-01...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
Adminer script versions up to 4.6.2 contains file disclosure vulnerability
More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2018-006: Code execution vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2018-006/...
SS-2018-008: BackURL validation bypass with malformed URLs
More info at https://www.silverstripe.org/download/security-releases/ss-2018-008/...
Potential SQL injection vector
The SelectLimit function has a potential SQLi exploit through the use of the nrows and offset parameters which are not forced to integers. Fixes 400...
Non-Persistent XSS
More info at https://community.shopware.com/detail2048.html...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-005/...
Invalid token creation and validation
More info at https://simplesamlphp.org/security/201708-01...
Time-Based Information Disclosure Vulnerability in Flow
More info at https://www.neos.io/blog/flow-sa-2016-001.html...
Potential SQL injection in ORDER and GROUP functions of ZF1
More info at https://framework.zend.com/security/advisory/ZF2016-03...
Information Disclosure in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-017...
Link injection
More info at https://simplesamlphp.org/security/201606-01...
Arbitrary File Disclosure in Form Component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-010/...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe - In most versions of PHP, it lies about being secure - And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: - Release a new version v1.3.0 or most likely v2.0.0 that...
Denial of Service attack possibility in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-008/...
Cross-Site Scripting in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
More info at https://framework.zend.com/security/advisory/ZF2015-08...
SS-2015-015: XSS in dev/build returnURL Parameter
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-015/...
State guessing vulnerability
By doing this we're protecting against people trying to guess the state...
Access bypass when editing file metadata
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...
SS-2015-012: External redirection risk in Security?ReturnURL
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-012/...
SS-2015-011: Potential SQL Injection Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...
Privilege Escalation in TYPO3 Neos
More info at https://www.neos.io/blog/neos-sa-2015-001.html...
Attackers able to impersonate users
Merge branch 'disabling-none-by-default'...
SS-2015-003: History XSS Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-003/...
Header injection in NativeMailerHandler
Hopefully attacker controlled data is never used to set the encoding or content type, but just in case, prevent: $nmh = new NativeMailerHandler$to, $subject, $from; $nmh-setEncoding "utf-8\r\nFrom: [email protected]"; Since the injection happened in send, there doesn't seem to be a good way to a...
Entropy is lost in the TokenGenerator
More info at https://symfony.com/blog/fosuserbundle-entropy-of-generated-tokens-is-lost...
Sendmail transport arbitrary shell execution
More info at http://blog.swiftmailer.org/post/88660759928/security-fix-swiftmailer-5-2-1-released...
Authentication adapter did not verify validity of tokens
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...
Hijacked authentication cookies vulnerability
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Fixed issue with broken validation of JSONP callbacks
More info at https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler...