1961 matches found
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...
Potential remote code execution in zend-mail via Sendmail adapter
More info at https://framework.zend.com/security/advisory/ZF2016-04...
Insecure Unserialize in TYPO3 Import/Export
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-015...
SS-2016-004: XSS in CMS Edit Page
More info at https://www.silverstripe.org/download/security-releases/ss-2016-004/...
Cross-Site Scripting in TYPO3 component Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/...
SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter
More info at https://www.silverstripe.org/download/security-releases/ss-2016-002/...
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/...
TYPO3 is susceptible to Cross-Site Flashing
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/...
Arbitrary file upload and XML External Entity processing
More info at https://www.neos.io/blog/flow-sa-2015-001.html...
SS-2015-017: Forum Module CSRF Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-017/...
SS-2015-018: File upload exposure on UserForms module
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-018/...
Cross-Site Scripting exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-004/...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
Privilege Escalation in TYPO3 Neos
More info at https://www.neos.io/blog/neos-sa-2015-001.html...
SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled
More info at https://www.silverstripe.org/download/security-releases/ss-2016-014/...
SS-2016-013: Member.Name is not escaped
More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
SS-2015-005: VirtualPage XSS
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-005/...
Session validation vulnerability
More info at https://framework.zend.com/security/advisory/ZF2015-01...
Possible cache poisining on the homepage when anchors are used
More info at https://typo3.org/security/advisory/typo3-core-sa-2014-003...
The ExtJS JavaScript framework that is shipped with TYPO3 is susceptible to XSS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/...
Insufficient input validation allows for code injection and remote execution
More info at https://contao.org/en/news/new-security-hole-found-in-contao.html...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Vulnerability in the filesystem loader
More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...
local file access in `Client:send` via manipulation of `$protocol` argument
security fix: hardened the Client::send method against misuse of the $method argument issue 81. Abusing its value, it was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url the one used in the Client constructor. This weakne...
XSS vector in Zend_Filter_StripTags
More info at https://framework.zend.com/security/advisory/ZF2009-02...
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
More info at https://symfony.com/cve-2024-50343...
Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001
More info at https://www.drupal.org/sa-core-2020-001...
Anonymous Open Redirect - Moderately Critical - Open Redirect
More info at https://www.drupal.org/sa-core-2018-006...
Authentication bypass via attacker provided openid server
Impact The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from steamcommunity.com, allowing a malicious actor to substitute their own openID server. Patches This vulnerability only affects the outdated v1.x versions of the package. These are no longer...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
More info at https://symfony.com/cve-2026-45063...
CVE-2026-45072: Stored XSS in WebProfiler CodeExtension::fileExcerpt(): Unescaped Non-PHP File Rendering
More info at https://symfony.com/cve-2026-45072...
Possible sandbox bypass when using a source policy
More info at https://symfony.com/cve-2026-24425...
TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...
TYPO3-EXT-SA-2026-035: Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-035...
Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...
Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...
Cross-site scripting in the Colorbox caption (see GHSA-rr85-7j77-pppg)
More info at https://github.com/contao-components/colorbox/security/advisories/GHSA-rr85-7j77-pppg...
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...
Insecure default secret key and IV allowing anyone to decrypt values
This issue has been deleted...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...