1802 matches found
Security Misconfiguration in Install Tool Cookie
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...
Magento 2.2.5 and 2.1.14 Security update
More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...
URL Rewrite vulnerability
More info at https://framework.zend.com/security/advisory/ZF2018-01...
SS-2017-002: Member disclosure in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2017-002/...
SS-2017-003: XSS in RedirectorPage
More info at https://www.silverstripe.org/download/security-releases/ss-2017-003/...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-018...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-014/...
SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers
More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
User authentication bypass
More info at https://thelia.net/version-2-1-3-with-security-fix...
Authentication Vulnerability - possible attempt to login via zero-valued password credential
Security advisory: zero-valued authentication credentials vulnerability DoctrineModule version 0.7.2 has been just released and includes a security fix for 248 via @5f79a9f7b and @78018ef568, Affected versions All versions below 0.7.2 are affected. dev-master and 0.8.x are not affected starting...
Route Parameter Injection Via Query String in Zend\Mvc
More info at https://framework.zend.com/security/advisory/ZF2013-01...
Potential XSS vector in Zend_Dojo_View_Helper_Editor
More info at https://framework.zend.com/security/advisory/ZF2010-02...
CVE-2026-45068: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
More info at https://symfony.com/cve-2026-45068...
CVE-2026-45073: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
More info at https://symfony.com/cve-2026-45073...
CVE-2026-45756: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits: ReDoS
More info at https://symfony.com/cve-2026-45756...
CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
More info at https://symfony.com/cve-2026-45063...
Anonymous Open Redirect - Moderately Critical - Open Redirect
More info at https://www.drupal.org/sa-core-2018-006...
Drupal core - Moderately critical - Denial of Service
More info at https://www.drupal.org/sa-core-2024-001...
TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands
More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-023...
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026...
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
More info at https://contao.org/en/security-advisories/unrestricted-activation-email-resending...
Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...
Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)
More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...
Cross-site scripting in the Colorbox caption (see GHSA-rr85-7j77-pppg)
More info at https://github.com/contao-components/colorbox/security/advisories/GHSA-rr85-7j77-pppg...
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
More info at https://contao.org/en/security-advisories/exposure-of-sensitive-information-through-a-stale-search-index...
Fixes redirect uri validation in oauth
More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...
EZSA-2019-001 XSS in Admin UI
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
EZSA-2018-009 Do not interpret PHP/PHAR uploads
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2018-001...
SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt
More info at https://www.silverstripe.org/download/security-releases/ss-2017-009/...
SS-2017-005: User enumeration via timing attack on login and password reset forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...
EZSA-2017-006 Information disclosure in backend content tree menu
More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Null reset codes were allowed
More info at https://haxx.ml/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other...
Missing Access Check in TYPO3 CMS
More info at https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms/...
Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word
More info at https://framework.zend.com/security/advisory/ZF2015-09...
SS-2015-013: X-Forwarded-Host request hostname injection
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...
Fixes a security issue where the session could be hijacked
Changelog ========= 4.1.0 2026-02-13 Convert XML config files to other formats to fix the deprecation of XML config files in Symfony Add PHP routing files alongside the XML ones. Loading the XML routing files triggers a deprecation in Symfony 7.4. Fix deprecation in the UserChecker Fix the...
Possible sandbox bypass when using a source policy
More info at https://symfony.com/cve-2026-24425...
TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-comments-bundle...
Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)
More info at https://contao.org/en/security-advisories/cross-site-request-forgery-in-custom-backend-actions...
Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)
More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...