1961 matches found
SS-2018-005: isDev and isTest unguarded
More info at https://www.silverstripe.org/download/security-releases/ss-2018-005/...
SS-2018-011: SQL injection vulnerability
More info at https://www.silverstripe.org/download/security-releases/ss-2018-011/...
SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...
SS-2017-006: Session user agent change detection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-006/...
Flow Bugfix Releases for Entity Security
More info at https://www.neos.io/blog/flow-bugfix-releases-for-entity-security.html...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...
SS-2016-010: ReadOnly transformation for formfields exploitable
More info at https://www.silverstripe.org/download/security-releases/ss-2016-010/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
SS-2016-005: Brute force bypass on default admin
More info at https://www.silverstripe.org/download/security-releases/ss-2016-005/...
Potential Insufficient Entropy Vulnerability in ZF1
More info at https://framework.zend.com/security/advisory/ZF2016-01...
TYPO3 is susceptible to Cross-Site Flashing
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/...
Arbitrary file upload and XML External Entity processing
More info at https://www.neos.io/blog/flow-sa-2015-001.html...
SS-2015-027: HtmlEditor embed url sanitisation
More info at https://www.silverstripe.org/download/security-releases/ss-2015-027/...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
XXE Vulnerability
Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...
SS-2016-013: Member.Name is not escaped
More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...
SS-2015-010: XSS in Director::force_redirect()
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect/...
SS-2015-006: XSS In GridField print
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-006/...
XSS vulnerability in login redirect param
Security advisory: XSS vulnerability in login redirect param ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in https://github.com/SocalNick/ScnSocialAuth/commit/4a00966c41bc37251586d007564c5c891eba3700 Affected versions All...
Session validation vulnerability
More info at https://framework.zend.com/security/advisory/ZF2015-01...
SS-2014-017: XML Quadratic Blowup Attack
More info at https://www.silverstripe.org/software/download/security-releases/ss-2014-017-xml-quadratic-blowup-attack/...
Insufficient input validation allows for code injection and remote execution
More info at https://contao.org/en/news/new-security-hole-found-in-contao.html...
Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress
More info at https://framework.zend.com/security/advisory/ZF2013-04...
Potential SQL injection due to execution of platform-specific SQL containing interpolations
More info at https://framework.zend.com/security/advisory/ZF2013-03...
Vulnerability in the EntityUserProvider as provided in the Doctrine bridge
More info at https://symfony.com/blog/security-release-symfony-2-0-6...
Security fixes related to the way XML is handled
More info at https://symfony.com/blog/security-release-symfony-2-0-17-released...
Potential SQL Injection Vector When Using PDO_MySql
More info at https://framework.zend.com/security/advisory/ZF2011-02...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
More info at https://www.drupal.org/sa-core-2019-009...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
Reflected Cross-Site-Scripting
More info at https://simplesamlphp.org/security/201907-01...
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
More info at https://symfony.com/cve-2026-46637...
TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension "Analytics" (analytics)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...
TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-023...
TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-022...
TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
SS-2018-007: CSRF vulnerability in graphql
More info at https://www.silverstripe.org/download/security-releases/ss-2018-007/...
Magento 2.2.7 and 2.1.16 Security update. Closes RCE,XSS and other vulnerabilities
More info at https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
SS-2017-007: CSV Excel Macro Injection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...
XSS in class documenting_xmlrpc_server
More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...
XSS vulnerabilities in Neos
More info at https://www.neos.io/blog/neos-sa-2015-002.html...