1961 matches found
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...
Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...
Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...
TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...
Arbitrary code execution
Impact PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain an arbitrary code execution vulnerability in PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey. The vulnerable method is reached by any sniff that extends AbstractArrayDeclarationSniff and calls...
Regression in Query Parenthesis can have Security Implications
Return insensitive check after 8453 Problem: -andWhere"u.name = ?1 or u.username = ?1"; did not wrap part in parenthesis when or or and was written in lowercase anymore. It still worked for uppercase OR and AND. Fixes 8595...
IBEXA-SA-2020-007 Failing access control in system info view
More info at https://developers.ibexa.co/security-advisories/ibexa-sa-2020-007-failing-access-control-in-system-info-view...
SSTI Vulnerability
More info at https://twitter.com/nystudio107/status/1268736336200171520?lang=en...
EZSA-2020-003 XSS in DemoBundle/ezdemo bundled VideoJS
More info at https://ezplatform.com/security-advisories/ezsa-2020-003-xss-in-demobundle-ezdemo-bundled-videojs...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector
More info at https://www.silverstripe.org/download/security-releases/ss-2018-020/...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
EZSA-2018-006 XSS vulnerability in 'disabled module' error template
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template...
SS-2018-016: Unsafe SQL Query Construction (Safe Data Source)
More info at https://www.silverstripe.org/download/security-releases/ss-2018-016/...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
SUPEE-10752 - Multiple security enhancements vulnerabilities
More info at https://magento.com/security/patches/supee-10752...
Incorrect header injection check
Security: Reject header injections correctly, see 4...
SQL injection possible with limit() on MySQL
The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: php UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...
Non-Persistent XSS
More info at https://community.shopware.com/detail2048.html...
Cross-Site Scripting in TYPO3 CMS Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-004/...
Missing state parameter in OAuth requests leading to CSRF vulnerability
No description provided...
Authentication Bypass in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-002/...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Cross-Site Scripting in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-003/...
Potential remote code execution in zend-mail via Sendmail adapter
More info at https://framework.zend.com/security/advisory/ZF2016-04...
ImageMagick driver does not escape all shell arguments.
More info at https://fuelphp.com/security-advisories...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-011/...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-009/...
SS-2015-028: Missing security check on dev/build/defaults
More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...
SQL Injection in dbal
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-016/...
Multiple Cross-Site Scripting vulnerabilities in frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Arbitrary file upload and XML External Entity processing
More info at https://www.neos.io/blog/flow-sa-2015-001.html...
Critical SQL injection bug in the ODBC database driver
More info at https://forum.codeigniter.com/thread-65803.html...
Insecure state generation
More info at https://github.com/laravel/socialite/pull/91...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
SS-2016-015: XSS In OptionsetField and CheckboxSetField
More info at https://www.silverstripe.org/download/security-releases/ss-2016-015/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...