1802 matches found
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
EZSA-2018-008 REST API returns list of all SiteAccesses
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses...
Magento 2.2.6 and 2.1.15 Security update
More info at https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update...
SS-2017-006: Session user agent change detection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...
SS-2017-007: CSV Excel Macro Injection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...
Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...
Time-Based Information Disclosure Vulnerability in Flow
More info at https://www.neos.io/blog/flow-sa-2016-001.html...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
TYPO3 is susceptible to Cross-Site Flashing
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
More info at https://symfony.com/cve-2015-8124...
Arbitrary file upload and XML External Entity processing
More info at https://www.neos.io/blog/flow-sa-2015-001.html...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
XXE Vulnerability
Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...
SS-2016-013: Member.Name is not escaped
More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...
SS-2015-010: XSS in Director::force_redirect()
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect/...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
XSS injection in backoffice
More info at https://thelia.net/version-2-1-2-with-security-fix...
SS-2015-006: XSS In GridField print
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-006/...
Session validation vulnerability
More info at https://framework.zend.com/security/advisory/ZF2015-01...
Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress
More info at https://framework.zend.com/security/advisory/ZF2013-04...
Vulnerability in the EntityUserProvider as provided in the Doctrine bridge
More info at https://symfony.com/blog/security-release-symfony-2-0-6...
Security fixes related to the way XML is handled
More info at https://symfony.com/blog/security-release-symfony-2-0-17-released...
Insecure Unserialize Vulnerability in FLOW3
More info at https://www.neos.io/blog/flow-sa-2012-001.html...
SQL injection possibility
More info at https://www.doctrine-project.org/blog/dbal-security-2011-1.html...
Potential SQL Injection Vector When Using PDO_MySql
More info at https://framework.zend.com/security/advisory/ZF2011-02...
CVE-2026-45071: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true
More info at https://symfony.com/cve-2026-45071...
PHP code injection via `{% use %}` template name
More info at https://symfony.com/cve-2026-46633...
Sandbox property allowlist bypass via the `column` filter (array_column on objects)
More info at https://symfony.com/cve-2026-46635...
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
More info at https://symfony.com/cve-2026-45756...
Cookie serialization vulnerability
More info at https://laravel.com/docs/5.6/upgradeupgrade-5.6.30...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
More info at https://www.drupal.org/sa-core-2019-009...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
CVE-2026-45064: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing
More info at https://symfony.com/cve-2026-45064...
TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...
TYPO3-EXT-SA-2026-025: Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025...
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...
TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...
IBEXA-SA-2020-007 Failing access control in system info view
More info at https://developers.ibexa.co/security-advisories/ibexa-sa-2020-007-failing-access-control-in-system-info-view...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
EZSA-2019-003 XSS in eZFind spellcheck
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-003-xss-in-ezfind-spellcheck...
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Cross-Site Scripting in Language Pack Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...
SS-2018-019: Possible denial of service attack vector when flushing
More info at https://www.silverstripe.org/download/security-releases/ss-2018-019/...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...