1717 matches found
EZSA-2018-007 User data disclosure
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...
Magento 2.2.5 and 2.1.14 Security update
More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...
Frontend login Session Fixation
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003/...
Incorrect CSRF validation
More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...
SS-2016-011: ChangePasswordForm does not check Member::canLogIn()
More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...
XSS vulnerability in login redirect param
Security advisory: XSS vulnerability in login redirect param ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in 4a00966 Affected versions All versions below 1.15.2 are affected. dev-master is fixed starting from 4a00966 Exploits...
SS-2018-015: Vulnerable dependency
More info at https://www.silverstripe.org/download/security-releases/ss-2018-015/...
The `spaceless` filter implicitly marks its output as safe
More info at https://symfony.com/cve-2026-46628...
CVE-2025-64500: Incorrect parsing of PATH_INFO can lead to limited authorization bypass
More info at https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2018-001...
Null reset codes were allowed
More info at https://haxx.ml/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other...
Arbitrary code execution
Impact WordPress Coding Standards WordPressCS versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, ...
Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
EasyAdmin's FileField and ImageField accept browser-executable file types by default FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG. When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin...
Incorrect Ed25519 public key validation
!NOTE The fix was released in v2.5.1 Reported by Arpit Jain @arpitjain099 via email. This validation gate misfires, allowing invalid public keys to be loaded. Full advisory: https://github.com/paragonie/sodiumcompat/security/advisories/GHSA-733q-f2wq-9c8w The actual downstream impact is minimal i...
Arbitrary code execution
More info at https://github.com/PHPCSStandards/PHPCSUtils/security/advisories/GHSA-r6hr-vr92-vv28...
Client HttpTransport SSE buffer grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...