1717 matches found
TYPO3-CORE-SA-2022-009: Stored Cross-Site Scripting via FileDumpController
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-009...
CVE-2021-41559: Quadratic blowup in Convert::xml2array()
More info at https://www.silverstripe.org/download/security-releases/cve-2021-41559...
TYPO3-CORE-SA-2022-003: Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-003...
A cross-site scripting vulnerability
Impact SVG sanitizer library before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected. Patches This issue is fix...
Access to restricted PHP code by dynamic static class access
Impact Template authors could run restricted static php methods. Patches Please upgrade to 3.1.40 or higher. References See the documentation on Smarty security features on the staticclasses access filter. For more information If you have any questions or comments about this advisory please open ...
CVE-2022-21647: Deserialization of Untrusted Data in Codeigniter4
Impact Deserialization of Untrusted Data was found in the old function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection...
CVE-2022-37430 - Stored XSS using uppercase characters in HTMLEditor
More info at https://www.silverstripe.org/download/security-releases/cve-2022-37430...
Read private customer data reclaiming carts
Klaviyo read customer quotes for guest carts April 28th I've found a endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API. Data...
TYPO3-CORE-SA-2021-002: Unrestricted File Upload in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-002...
Insecure Deserialization of untrusted data
Description Impact Unserialization of untrusted data. Patches The issue has been patched and users of Requests 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. References Publications about the vulnerability:...
TYPO3-CORE-SA-2020-008: Sensitive Information Disclosure
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-008...
Possible deserialization side-effects in symfony/cache
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...
PRODSECBUG-2371: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2222: Deletion of user roles via cross-site request forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2095: Defense-in-depth session validation check implemented
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2171: Insecure token implementation leads to Cross-Site Request Forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2202: Security bypass via form data injection
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2266: Arbitrary code execution through malicious elastic search module configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2226: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PHP Code Injection
phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...
CVE-2017-16652: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2017-16652...
File upload access bypass and denial of service
More info at https://www.drupal.org/SA-CORE-2016-001...
PHP remote file inclusion vulnerability in dompdf.php
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...
Cross-site scripting (XSS) vulnerability in the system log
More info at https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html...
CVE-2024-50340: Ability to change environment from query
More info at https://symfony.com/cve-2024-50340...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005
More info at https://www.drupal.org/sa-core-2019-005...
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Summary Composer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUBTOKEN values. These tokens are validated in the same way by Composer on GitHu...
TYPO3-EXT-SA-2025-007: Multiple vulnerabilities in extension "Backup Plus" (ns_backup)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-007...
TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2023-006...
Improper header validation
Impact Improper header parsing. An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. Patches The issue is patched in 1.9.1 and 2.4.5...
CVE-2023-25575: Secured properties may be accessible within collections
Impact Resource properties secured with the security option of the ApiPlatform\Metadata\ApiProperty attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON, which is enabled by default when installing API Platform. Custom serialization...
TYPO3-EXT-SA-2023-002: Persisted Cross-Site Scripting in extension "Forms Export" (frp_form_answers)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-002...
Dompdf vulnerable to URI validation failure on SVG parsing
Summary The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing tags with uppercase letters. This might leads to arbitrary object unserialize on PHP tags, in src/Image/Cache.php : if $type === "svg" $parser = xmlparsercreate"utf-8"; xmlparsersetoption$parser,...
smarty_function_mailto - JavaScript injection in eval function
I found a bug in the Smarty package, specifically in the smartyfunctionmailto$params function. Remote exploitation of such vulnerability is unlikely, but it is still advisable to take it into account. A web page that uses this function and that could be parameterized using GET or POST input...
TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-008...
Cross-domain cookie leakage
Impact Previous version of Guzzle contain a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains...
Path Traversal within joomla/archive tar class
More info at https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html...
TYPO3-CORE-SA-2020-012: XML External Entity in Dashboard Widget
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-012...
TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-011...
SQL injection relating to data display
More info at https://www.phpmyadmin.net/security/PMASA-2020-4/...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
PRODSECBUG-2407: Remote code execution due to unsafe PHP archieve deserialization in the import functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
EZSA-2019-005 Bundled jQuery affected by CVE-2019-11358
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-005-bundled-jquery-affected-by-cve-2019-11358...
Possible deserialization side-effects in symfony/cache
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...
PRODSECBUG-2325: Denial-of-service by forcing a store to respond with a 404 error
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...