1769 matches found
SS-2016-012: Missing ACL on reports
More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
Attackers able to impersonate users
Merge branch 'disabling-none-by-default'...
SS-2015-004: TreeDropdownField and TreeMultiSelectField XSS
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-004/...
SS-2015-003: History XSS Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-003/...
SS-2015-007: XSS In FormAction
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-007/...
Possible cache poisining on the homepage when anchors are used
More info at https://typo3.org/security/advisory/typo3-core-sa-2014-003...
SecurityComponent cross form submission issue
More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...
Hijacked authentication cookies vulnerability
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...
Possible DOS attack with long user-submitted passwords
More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...
Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components
More info at https://framework.zend.com/security/advisory/ZF2013-02...
Request::getClientIp() when the trust proxy mode is enabled
More info at https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4...
Fixed the user refreshing to check the identity by primary key instead of username
Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
XSS vector in Zend_Filter_StripTags
More info at https://framework.zend.com/security/advisory/ZF2009-02...
CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
More info at https://symfony.com/cve-2026-45305...
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
More info at https://symfony.com/cve-2024-50343...
CVE-2026-45069: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
More info at https://symfony.com/cve-2026-45069...
Information disclosure
More info at https://simplesamlphp.org/security/201911-02...
Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
More info at https://symfony.com/blog/cve-2026-48807-sandbox-tostring-policy-bypass-via-traversable-in-join-replace-and-in-not-in-operators...
CVE-2026-48760: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
More info at https://symfony.com/cve-2026-48760...
Vulnerability to bypass two-factor authentication with remember-me option
Bundle version: 4.10.0 Symfony version: 3.4.31 Description Bypass 2fa by rememberme cookie To Reproduce We have a login form with rememberme checkbox functionality, When using the checkbox, symfony creates a cookie "REMEMBERME". That moment we get redirected to the 2fa-auth page. We have no acces...
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013
More info at https://www.drupal.org/sa-core-2020-013...
Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
More info at https://symfony.com/cve-2026-48736...
CVE-2026-45065: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
More info at https://symfony.com/cve-2026-45065...
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2021-005
More info at https://www.drupal.org/sa-core-2021-005...
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
More info at https://symfony.com/cve-2026-45072...
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
More info at https://symfony.com/cve-2026-48489...
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
More info at https://symfony.com/blog/cve-2026-46636-sandbox-filter-tag-and-function-allow-list-bypass-when-sandbox-state-changes-between-renders...
Filter input to avoid XPath injection
Filter input for its use in XPath expressions In order to avoid XPath injection, user input must be filtered before it ends up in the query. Unfortunately, there's no way to do this with a standard method in PHP, so we need our own filtering function. Current best practice recommends using white...
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
More info at https://symfony.com/cve-2026-46629...
Incorrect Ed25519 public key validation
!NOTE The fix was released in v2.5.1 Reported by Arpit Jain @arpitjain099 via email. This validation gate misfires, allowing invalid public keys to be loaded. Full advisory: https://github.com/paragonie/sodiumcompat/security/advisories/GHSA-733q-f2wq-9c8w The actual downstream impact is minimal i...
CVE-2026-54718 - Remote code execution via advanced workflow email template
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54718...
CVE-2026-54721 - Remote code execution via userforms email subject
More info at https://www.silverstripe.org/download/security-releases/cve-2026-54721...
CRLF injection via URI host component
Impact guzzlehttp/psr7 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. The issue requires a PSR-7 request to be serialized into a raw HTTP/1.x message, for example with GuzzleHttp\Psr7\Message::toString or an equivalent custom serializer. Creating a...
SQL Injection in extension "News system" (news)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-010...
TYPO3-EXT-SA-2026-012: SQL Injection in extension "Address List" (tt_address)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-012...
SS-2023-001 - XSS vulnerability in underlying TinyMCE library
More info at https://www.silverstripe.org/download/security-releases/SS-2023-001...
$this->validate() returns all properties, not just validated ones
IMPORTANT BUGFIX $this-validate usually only returns the validated dataset, however a regression was introduced, that caused it to return ALL data on the Livewire component. 1659...
EZSA-2020-004 Object Injection in SiteAccessMatchListener
More info at https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...