1702 matches found
makeCollapsible allows applying event handler to any CSS selector
More info at https://phabricator.wikimedia.org/T246602...
User content can redirect the logout button to different URL
More info at https://phabricator.wikimedia.org/T232932...
SQL injection with processing username
More info at https://www.phpmyadmin.net/security/PMASA-2020-2/...
XSS vulnerability in blade templating
More info at https://github.com/laravel/framework/pull/31945...
XSS vulnerability in blade templating
More info at https://github.com/laravel/framework/pull/31945...
SQL injection relating to data display
More info at https://www.phpmyadmin.net/security/PMASA-2020-4/...
Fixes redirect uri validation in oauth
More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
CVE-2019-19325: XSS through non-scalar FormField attributes
More info at https://www.silverstripe.org/download/security-releases/cve-2019-19325/...
Relative Path Traversal (CWE-23) in chunked uploads
Description Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validati...
Relative Path Traversal (CWE-23) in chunked uploads
Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validating these...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released https://blog.laravel.com/security-laravel-62012-7303-released...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
SQL injection in user accounts page
More info at https://www.phpmyadmin.net/security/PMASA-2020-1/...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible to circumvent title-blacklist
More info at https://phabricator.wikimedia.org/T239466...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
More info at https://symfony.com/cve-2019-18888...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
Critical signature bypass
More info at https://simplesamlphp.org/security/201911-01...
PRODSECBUG-2390: Broken authentication and session managememt
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2401: Cross-Site Scripting via Customer Attribute Option Value
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2392: Cross-Site Scripting via PageBuilder Banner
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2424: SQL injection when accessing group data in email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2423: Cross-Site Scripting via inventory source
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2422: Cross-Site Scripting via Email Template Name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2418: SQL injection via marketing account with access to email templates variables
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...