1773 matches found
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
SS-2018-007: CSRF vulnerability in graphql
More info at https://www.silverstripe.org/download/security-releases/ss-2018-007/...
Magento 2.2.7 and 2.1.16 Security update. Closes RCE,XSS and other vulnerabilities
More info at https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update...
SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension
More info at https://www.silverstripe.org/download/security-releases/ss-2018-017/...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
SS-2018-014: Dangerous file types in allowed upload
More info at https://www.silverstripe.org/download/security-releases/ss-2018-014/...
Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/...
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...
Cross-Site Scripting in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-003/...
SS-2016-010: ReadOnly transformation for formfields exploitable
More info at https://www.silverstripe.org/download/security-releases/ss-2016-010/...
SQL Injection in TYPO3 Frontend Login
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-016...
SS-2016-005: Brute force bypass on default admin
More info at https://www.silverstripe.org/download/security-releases/ss-2016-005/...
Potential Insufficient Entropy Vulnerability in ZF1
More info at https://framework.zend.com/security/advisory/ZF2016-01...
Cross-Site Scripting in TYPO3 component Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/...
TYPO3 is susceptible to Cross-Site Flashing
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/...
SS-2015-027: HtmlEditor embed url sanitisation
More info at https://www.silverstripe.org/download/security-releases/ss-2015-027/...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...
SS-2016-013: Member.Name is not escaped
More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...
SS-2015-010: XSS in Director::force_redirect()
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect/...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
SS-2015-006: XSS In GridField print
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-006/...
Arbitrary Shell Execution in Swiftmailer library
More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
Vulnerability in the filesystem loader
More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...
Route Parameter Injection Via Query String in Zend\Mvc
More info at https://framework.zend.com/security/advisory/ZF2013-01...
Request::getClientIp() when the trust proxy mode is enabled
More info at https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4...
Potential Proxy Injection Vulnerabilities in Multiple Zend Framework 2 Components
More info at https://framework.zend.com/security/advisory/ZF2012-04...
Security fixes related to the way XML is handled
More info at https://symfony.com/blog/security-release-symfony-2-0-17-released...
Insecure Unserialize Vulnerability in FLOW3
More info at https://www.neos.io/blog/flow-sa-2012-001.html...
Potential SQL Injection Vector When Using PDO_MySql
More info at https://framework.zend.com/security/advisory/ZF2011-02...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
More info at https://www.drupal.org/sa-core-2019-009...
CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
More info at https://symfony.com/cve-2026-45063...
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-918: Server-Side Request Forgery SSRF CVSS vector v.3.1: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS vector v.4.0: 8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description: SSRF occurs when a processed HTML document is read and...
CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
More info at https://symfony.com/cve-2026-45063...
The `spaceless` filter implicitly marks its output as safe
More info at https://symfony.com/cve-2026-46628...
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
More info at https://symfony.com/cve-2026-45072...
Possible sandbox bypass when using a source policy
More info at https://symfony.com/cve-2026-24425...
CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
More info at https://symfony.com/cve-2026-45074...
TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020...
TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
TYPO3-EXT-SA-2026-025: Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...
Arbitrary Code Execution via File List Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-008...
Denial of service
Make the world a bit safer...
Information Disclosure in Install Tool
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...