1802 matches found
CVE-2019-10909: Escape validation messages in the PHP templating engine
More info at https://symfony.com/cve-2019-10909...
TYPO3-EXT-SA-2026-009: Broken Access Control in extension "Frontend User Registration" (sf_register)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-009...
Improper header validation
Impact Improper header parsing. An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. Patches The issue is patched in 1.9.1 and 2.4.5...
TYPO3-EXT-SA-2023-002: Persisted Cross-Site Scripting in extension "Forms Export" (frp_form_answers)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-002...
TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-015...
TYPO3-CORE-SA-2022-001: Information Disclosure via Export Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-001...
Cross-domain cookie leakage
Impact Previous version of Guzzle contain a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains...
PHP Code Injection by malicious block or filename
Impact Template authors could inject php code by choosing a malicous block name or include file name. Sites that cannot fully trust template authors should update asap. Patches Please upgrade to the most recent version of Smarty v3 or v4. Workarounds Is there a way for users to fix or remediate t...
CVE-2022-21647: Deserialization of Untrusted Data in Codeigniter4
Description Impact Deserialization of Untrusted Data was found in the old function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL...
CVE-2022-38148 - Blind SQL Injection via GridFieldSortableHeader
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38148...
SQL Injection in Limit Clause Generation API
We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction. We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately. The vulnerability can happen when...
TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-015...
Improper escaping of command arguments on Windows leading to command injection
Impact Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. Patches 1.10.23 and 2.1.9 fix the issue Workarounds None...
TYPO3-CORE-SA-2021-013: Cross-Site Scripting via Rich-Text Content
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-013...
Improper Certificate Validation in WP-CLI framework
Impact An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability...
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
More info at https://symfony.com/cve-2021-21424...
Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags
More info at https://phabricator.wikimedia.org/T279451...
TYPO3-CORE-SA-2021-004: Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-004...
TYPO3-CORE-SA-2021-005: Denial of Service in Page Error Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-005...
TYPO3-CORE-SA-2021-001: Open Redirection in Login Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-001...
TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-011...
TYPO3-CORE-SA-2020-008: Sensitive Information Disclosure
More info at https://typo3.org/security/advisory/typo3-core-sa-2020-008...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
PRODSECBUG-2325: Denial-of-service by forcing a store to respond with a 404 error
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
SQL injection vulnerabililty in the back end search filter and the front end listing module
More info at https://contao.org/en/news/contao-3531.html...
Drupal Core - Highly Critical - Injection - SA-CORE-2016-003
More info at https://www.drupal.org/SA-CORE-2016-003...
Request::getHost() poisoning
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
Request::getHost() poisoning
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
XML External Entity (XXE) issue
thanks to Kousuke Ebihara for the report and patch...
XML External Entity (XXE) issue
disable external XML entities and libxml errors thanks to Kousuke Ebihara for the report and patch...
Mautic core - Highly Critical - XSS vulnerability leveraged through referrers could allow un-authorized admin access
More info at https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4...
Critical - Remote Code Execution
More info at https://www.drupal.org/sa-core-2018-004...
CVE-2020-5220: Ability to define unintended serialisation groups via HTTP header which might lead to data exposure
Impact ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...
CVE-2019-12186: XSS injection in the Grid component
More info at https://sylius.com/blog/cve-2019-12186/...
Possible cross-site scripting (XSS) vulnerability in the Blade templating engine
A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine. Given the following two Blade templates: resources/views/parent.blade.php: html @section'content' @show resources/views/child.blade.php: html @extends'parent' @section'content' @endsection And a route...
CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
More info at https://symfony.com/cve-2026-46644...
TYPO3-EXT-SA-2025-007: Multiple vulnerabilities in extension "Backup Plus" (ns_backup)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-007...
CVE-2023-46735: Potential XSS in WebhookController
More info at https://symfony.com/cve-2023-46735...
TYPO3-EXT-SA-2023-007: Broken Access Control in extension "hCaptcha for EXT:form" (hcaptcha)
More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-007...
TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...
TYPO3-CORE-SA-2021-003: Broken Access Control in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-003...
Allows write operations with Directory Traversal due to inadequate checking of symbolic links
Disallow symlinks to out-of-path filenames...
PRODSECBUG-2456: Broken authentication and session managememt
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2222: Deletion of user roles via cross-site request forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2266: Arbitrary code execution through malicious elastic search module configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2317: Stored cross-site scripting in admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...