1769 matches found
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Security Misconfiguration in Install Tool Cookie
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Cross-Site Scripting in Frontend User Login
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...
Magento 2.2.7 and 2.1.16 Security update. Closes RCE,XSS and other vulnerabilities
More info at https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update...
SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension
More info at https://www.silverstripe.org/download/security-releases/ss-2018-017/...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2018-014: Dangerous file types in allowed upload
More info at https://www.silverstripe.org/download/security-releases/ss-2018-014/...
SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...
SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt
More info at https://www.silverstripe.org/download/security-releases/ss-2017-009/...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-006/...
SS-2017-002: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2017-002/...
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
SS-2016-010: ReadOnly transformation for formfields exploitable
More info at https://www.silverstripe.org/download/security-releases/ss-2016-010/...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-018...
Missing Access Check in TYPO3 CMS
More info at https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms/...
Privilege Escalation in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-012/...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...
SS-2015-026: Form field validation message XSS vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2015-026/...
Remote File Inclusion through View template name manipulation
More info at https://bakery.cakephp.org/2015/11/05/cakephp30153142612276released.html...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
SS-2015-016: XSS in install.php
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-016/...
Information Disclosure possibility exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/...
SS-2015-013: X-Forwarded-Host request hostname injection
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...
Denial of Service attack through XML payloads
More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
Arbitrary Shell Execution in Swiftmailer library
More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...
SS-2014-017: XML Quadratic Blowup Attack
More info at https://www.silverstripe.org/software/download/security-releases/ss-2014-017-xml-quadratic-blowup-attack/...
Risk of mass-assignment vulnerabilities
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.29...
Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress
More info at https://framework.zend.com/security/advisory/ZF2013-04...
Authentication Vulnerability - possible attempt to login via zero-valued password credential
Security advisory: zero-valued authentication credentials vulnerability DoctrineModule version 0.7.2 has been just released and includes a security fix for 248 via @5f79a9f7b and @78018ef568, Affected versions All versions below 0.7.2 are affected. dev-master and 0.8.x are not affected starting...
Potential SQL injection due to execution of platform-specific SQL containing interpolations
More info at https://framework.zend.com/security/advisory/ZF2013-03...
Route Parameter Injection Via Query String in Zend\Mvc
More info at https://framework.zend.com/security/advisory/ZF2013-01...
Potential Proxy Injection Vulnerabilities in Multiple Zend Framework 2 Components
More info at https://framework.zend.com/security/advisory/ZF2012-04...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/dbal-security-2011-1.html...
Potential XSS vector in Zend_Dojo_View_Helper_Editor
More info at https://framework.zend.com/security/advisory/ZF2010-02...
PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser
Product: PhpSpreadsheet Version: 3.8.0 CWE-ID: CWE-918: Server-Side Request Forgery SSRF CVSS vector v.3.1: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS vector v.4.0: 8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description: SSRF occurs when a processed HTML document is read and...
CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
More info at https://symfony.com/cve-2026-45077...
Anonymous Open Redirect - Moderately Critical - Open Redirect
More info at https://www.drupal.org/sa-core-2018-006...
Reflected Cross-Site-Scripting
More info at https://simplesamlphp.org/security/201907-01...
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
More info at https://symfony.com/cve-2026-45756...
CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection
More info at https://symfony.com/cve-2026-45754...
CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection
More info at https://symfony.com/cve-2026-45755...
CVE-2026-47212: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
More info at https://symfony.com/cve-2026-47212...
PHP code injection via `{% use %}` template name
More info at https://symfony.com/cve-2026-46633...
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
More info at https://symfony.com/cve-2026-46635...