1961 matches found
Potential XSS Vectors in Multiple Zend Framework 2 Components
More info at https://framework.zend.com/security/advisory/ZF2012-03...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/doctrine-security-fix.html...
Contextual Links validation - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
Information disclosure
More info at https://simplesamlphp.org/security/201911-02...
Signature validation bypass
More info at https://simplesamlphp.org/security/201710-01...
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013
More info at https://www.drupal.org/sa-core-2020-013...
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
More info at https://www.drupal.org/sa-core-2019-012...
Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-006...
Guard bypass in Eloquent models
More info at https://blog.laravel.com/security-release-laravel-61834-7232...
PHP code injection via `{% use %}` template name
More info at https://symfony.com/cve-2026-46633...
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
More info at https://symfony.com/cve-2026-45756...
Padding Oracle Vulnerability in RSA Encryption
See https://framework.zend.com/security/advisory/ZF2015-10 it's essentially the same vulnerability...
Content moderation - Moderately critical - Access bypass
More info at https://www.drupal.org/sa-core-2018-006...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
More info at https://www.drupal.org/sa-core-2019-009...
Stored XSS on first/last name during setup
More info at https://www.passbolt.com/incidents/20190807multiplevulnerabilities...
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032...
TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-frontend-search-results...
SS-2023-001 - XSS vulnerability in underlying TinyMCE library
More info at https://www.silverstripe.org/download/security-releases/SS-2023-001...
IBEXA-SA-2020-006 Object Injection in legacy shop module
More info at https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module...
EZSA-2020-005 Editor XSS and trashed drafts in review queue
More info at https://ezplatform.com/security-advisories/ezsa-2020-005-editor-xss-and-trashed-drafts-in-review-queue...
Potentially sensitive data exposure
Impact Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish, messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch does not succeed. The dispatch method can be considered to not succeed...
EZSA-2020-004 Object Injection in SiteAccessMatchListener
More info at https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener...
Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
More info at https://www.drupal.org/sa-core-2020-003...
XSS vulnerability in blade templating
More info at https://github.com/laravel/framework/pull/31945...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Vulnerability to bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
EZSA-2019-002 Password reset vulnerability
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
EZSA-2018-008 REST API returns list of all SiteAccesses
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses...
SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension
More info at https://www.silverstripe.org/download/security-releases/ss-2018-017/...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
Adminer script versions up to 4.6.2 contains file disclosure vulnerability
More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2018-013: Passwords sent back to browsers under some circumstances
More info at https://www.silverstripe.org/download/security-releases/ss-2018-013/...
SS-2018-012: Uploaded PHP script execution in assets
More info at https://www.silverstripe.org/download/security-releases/ss-2018-012/...
SS-2018-005: isDev and isTest unguarded
More info at https://www.silverstripe.org/download/security-releases/ss-2018-005/...
XSS in some development error pages
More info at https://bakery.cakephp.org/2018/05/20/cakephp36435173414released.html...
SS-2018-001: Privilege Escalation Risk in Member Edit form
More info at https://www.silverstripe.org/download/security-releases/ss-2018-001/...
SS-2017-008: SQL injection in full text search of SilverStripe 4
More info at https://www.silverstripe.org/download/security-releases/ss-2017-008/...
Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/...
Cookie leakage to wrong origins and non-restricted cookie acceptance
Security and maintenance release. - Security: Previously cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax follows newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, b...