1717 matches found
SS-2023-001 - XSS vulnerability in underlying TinyMCE library
More info at https://www.silverstripe.org/download/security-releases/SS-2023-001...
Regular expression Denial of Service
More info at https://typo3.org/security/advisory/typo3-ext-sa-2021-002...
$this->validate() returns all properties, not just validated ones
IMPORTANT BUGFIX $this-validate usually only returns the validated dataset, however a regression was introduced, that caused it to return ALL data on the Livewire component. 1659...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Retrieval of HTTP-only cookies
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Cross-Site Scripting in Language Pack Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
Broken Access Control in Localization Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...
SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector
More info at https://www.silverstripe.org/download/security-releases/ss-2018-020/...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
Adminer script versions up to 4.6.2 contains file disclosure vulnerability
More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2018-005: isDev and isTest unguarded
More info at https://www.silverstripe.org/download/security-releases/ss-2018-005/...
Crypt encryption compromised.
More info at https://fuelphp.com/security-advisories...
Incorrect header injection check
Security: Reject header injections correctly, see 4...
SQL injection possible with limit() on MySQL
The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: php UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...
SS-2017-004: XSS in page history comparison
More info at https://www.silverstripe.org/download/security-releases/ss-2017-004/...
Missing state parameter in OAuth requests leading to CSRF vulnerability
More info at https://github.com/sensiolabs/connect/pull/63...
Authentication Bypass in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-002/...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Potential remote code execution in zend-mail via Sendmail adapter
More info at https://framework.zend.com/security/advisory/ZF2016-04...
Time-Based Information Disclosure Vulnerability in Flow
More info at https://www.neos.io/blog/flow-sa-2016-001.html...
Time-Based Information Disclosure Vulnerability in Flow
More info at https://www.neos.io/blog/flow-sa-2016-001.html...
SQL Injection in TYPO3 Frontend Login
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-016...
Insecure Unserialize in TYPO3 Import/Export
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-015...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-011/...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe In most versions of PHP, it lies about being secure And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: Release a new version v1.3.0 or most likely v2.0.0 that doesn't rely...
SQL Injection in dbal
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-016/...
Cross-Site Scripting in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
More info at https://framework.zend.com/security/advisory/ZF2015-08...
SS-2015-017: Forum Module CSRF Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-017/...
State guessing vulnerability
By doing this we're protecting against people trying to guess the state...
Access bypass when editing file metadata
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...
SS-2015-011: Potential SQL Injection Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...
XXE Vulnerability
Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...