1961 matches found
PRODSECBUG-2301: Names of disabled products can be leaked due to inadequate validation checks
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. js:core Fixed 2863 cssAutoLoad Array option is not working js:core Fixed 2862 stop autoSync when browser tab turn to background cmd:search Fixed 2867 support incremental search other than filename VD:abstract Fixed 2873 correct MIME-Type...
SUPEE-11086 - RCE, XSS, CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-11086...
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
More info at https://symfony.com/cve-2017-16653...
RCE vulnerability in phpunit
More info at https://nvd.nist.gov/vuln/detail/CVE-2017-9841...
CVE-2024-50340: Ability to change environment from query
More info at https://symfony.com/cve-2024-50340...
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
More info at https://symfony.com/cve-2023-46734...
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Summary Composer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUBTOKEN values. These tokens are validated in the same way by Composer on GitHu...
TYPO3-EXT-SA-2023-001: Broken Access Control in extension "femanager" (femanager)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-001...
CVE-2022-38145 - Stored XSS in Compare Mode
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38145...
TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-004...
CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy
More info at https://symfony.com/cve-2020-5275...
PRODSECBUG-2418: SQL injection via marketing account with access to email templates variables
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2187: Cross-site request forgery (CSRF) in checkout cart item
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2125: Deletion of Blocks via cross-site request forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
XSS vulnerability with unsafe link protocols
An XSS vulnerability CVE-2018-20583 has been identified in the following versions of this library: 0.15.6 0.15.7 0.16.0 0.17.0 0.17.1 0.17.2 0.17.3 0.17.4 0.17.5 0.18.0 It allows unsafe URLs to be added to links. The issue has been fixed in version 0.18.1. All users should upgrade to version 0.18...
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
More info at https://www.drupal.org/sa-core-2020-002...
CVE-2026-45067: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
More info at https://symfony.com/cve-2026-45067...
Unauthenticated crypto and weak IV in Magento\Framework\Encryption
More info at http://www.openwall.com/lists/oss-security/2016/07/19/3...
CVE-2023-46733: Possible session fixation
More info at https://symfony.com/cve-2023-46733...
TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-008...
URL Redirection to Untrusted Site ('Open Redirect')
Description Impact Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain. Patches 3.0.1 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Referenc...
CVE-2022-38724 - XSS in shortcodes
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38724...
TYPO3-CORE-SA-2021-008: Cross-Site Scripting in Content Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-008...
TYPO3-CORE-SA-2021-003: Broken Access Control in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-003...
TYPO3-CORE-SA-2021-001: Open Redirection in Login Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-001...
XSS relating to the transformation feature
More info at https://www.phpmyadmin.net/security/PMASA-2020-5/...
TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-003...
Relative Path Traversal (CWE-23) in chunked uploads
Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validating these...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released...
PRODSECBUG-2489: Cross side scripting during the preview of email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2349: Arbitrary code execution via file upload in admin import feature
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2244: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
Cross-Site Scripting in CKEditor
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-005...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
Denial of Service via HTTP/2 CONTINUATION Frames
Early versions of amphp/http-client with HTTP/2 support v4.0.0-rc10 to 4.0.0 will collect HTTP/2 CONTINUATION frames in an unbounded buffer and will not check the header size limit until it has received the ENDHEADERS flag, resulting in an OOM crash. Later versions of amphp/http-client v4.1.0-rc1...
Unrestricted file uploads
More info at https://contao.org/en/security-advisories/unrestricted-file-uploads.html...
CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
More info at https://symfony.com/cve-2026-48489...
TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2026-017...
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
More info at https://symfony.com/cve-2026-46644...
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-009...
TYPO3-EXT-SA-2024-003: Multiple vulnerabilities in "Events 2" (events2)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2024-003...
Denial of service caused by infinite recursion when parsing SVG images
More info at https://nvd.nist.gov/vuln/detail/CVE-2023-50262...
TYPO3-CORE-SA-2022-004: Cross-Site Scripting in Frontend Login Mailer
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-004...
Server-Side Request Forgery (SSRF) and URL Redirection to Untrusted Site ('Open Redirect')
Impact On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack depending on how AllTube is configured. The impact is mitigated by the fact the SSRF attack is only possible when the stream option is...
Server-Side Request Forgery (SSRF)
Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Part of the fix requires applyi...
CVE-2022-23601: CSRF token missing in forms
More info at https://symfony.com/cve-2022-23601...
CVE-2022-38724 - XSS in shortcodes
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38724...
Improper escaping of command arguments on Windows leading to command injection
Impact Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. Patches 1.10.23 and 2.1.9 fix the issue Workarounds None...
CVE-2021-41106: File reference keys leads to incorrect hashes on HMAC algorithms
Impact Users of HMAC-based algorithms HS256, HS384, and HS512 combined with Lcobucci\JWT\Signer\Key\LocalFileReference as key are having their tokens issued/validated using the file path as hashing key - instead of the contents. The HMAC hashing functions take any string as input and, since users...