1802 matches found
TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
TYPO3-EXT-SA-2026-023: Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...
TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...
Custom action dispatcher bypasses access_control on other routes
More info at https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
SS-2023-001 - XSS vulnerability in underlying TinyMCE library
More info at https://www.silverstripe.org/download/security-releases/SS-2023-001...
EZSA-2020-005 Editor XSS and trashed drafts in review queue
More info at https://ezplatform.com/security-advisories/ezsa-2020-005-editor-xss-and-trashed-drafts-in-review-queue...
Potentially sensitive data exposure
Impact Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish, messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch does not succeed. The dispatch method can be considered to not succeed...
Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
More info at https://www.drupal.org/sa-core-2020-003...
EZSA-2020-003 XSS in DemoBundle/ezdemo bundled VideoJS
More info at https://ezplatform.com/security-advisories/ezsa-2020-003-xss-in-demobundle-ezdemo-bundled-videojs...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
EZSA-2019-002 Password reset vulnerability
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector
More info at https://www.silverstripe.org/download/security-releases/ss-2018-020/...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
EZSA-2018-006 XSS vulnerability in 'disabled module' error template
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template...
SS-2018-016: Unsafe SQL Query Construction (Safe Data Source)
More info at https://www.silverstripe.org/download/security-releases/ss-2018-016/...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
SUPEE-10752 - Multiple security enhancements vulnerabilities
More info at https://magento.com/security/patches/supee-10752...
Adminer script versions up to 4.6.2 contains file disclosure vulnerability
More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2018-005: isDev and isTest unguarded
More info at https://www.silverstripe.org/download/security-releases/ss-2018-005/...
SS-2018-012: Uploaded PHP script execution in assets
More info at https://www.silverstripe.org/download/security-releases/ss-2018-012/...
SS-2018-013: Passwords sent back to browsers under some circumstances
More info at https://www.silverstripe.org/download/security-releases/ss-2018-013/...
Incorrect header injection check
Security: Reject header injections correctly, see 4...
Potential SQL injection vector
The SelectLimit function has a potential SQLi exploit through the use of the nrows and offset parameters which are not forced to integers. Fixes 400...
SQL injection possible with limit() on MySQL
The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: php UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...
SS-2017-008: SQL injection in full text search of SilverStripe 4
More info at https://www.silverstripe.org/download/security-releases/ss-2017-008/...
Cross-Site Scripting in TYPO3 CMS Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-004/...
Missing state parameter in OAuth requests leading to CSRF vulnerability
No description provided...
Cookie leakage to wrong origins and non-restricted cookie acceptance
Security and maintenance release. - Security: Previously cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax follows newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, b...
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
Authentication Bypass in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-002/...
Remote Code Execution in Qquoteadv/controllers/DownloadController.php
More info at https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
ImageMagick driver does not escape all shell arguments.
More info at https://fuelphp.com/security-advisories...
SS-2016-007: VersionedRequestFilter vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2016-007/...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-009/...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-011/...