1697 matches found
SQL injection relating to data display
More info at https://www.phpmyadmin.net/security/PMASA-2020-4/...
Fixes redirect uri validation in oauth
More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
EZSA-2020-001 Remote code execution in file uploads
More info at https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads...
CVE-2019-19325: XSS through non-scalar FormField attributes
More info at https://www.silverstripe.org/download/security-releases/cve-2019-19325/...
Relative Path Traversal (CWE-23) in chunked uploads
Description Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validati...
Relative Path Traversal (CWE-23) in chunked uploads
Impact The vulnerability was identified in the web service for a chunked file upload. While the names of the POST parameters vary with the used frontend, their values are always used in the same way to build a path where the chunks are stored and assembled temporarily. By not validating these...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released https://blog.laravel.com/security-laravel-62012-7303-released...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
SQL injection in user accounts page
More info at https://www.phpmyadmin.net/security/PMASA-2020-1/...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible to circumvent title-blacklist
More info at https://phabricator.wikimedia.org/T239466...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
More info at https://symfony.com/cve-2019-18888...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
Critical signature bypass
More info at https://simplesamlphp.org/security/201911-01...
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2407: Remote code execution due to unsafe PHP archieve deserialization in the import functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2426: Cross-Site Scripting via store name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2424: SQL injection when accessing group data in email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2422: Cross-Site Scripting via Email Template Name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2408: Unrestricted upload of file with dangerous type
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2425: Cross-Site Scripting via Signifyd Guarantee Option Translation Override
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2423: Cross-Site Scripting via inventory source
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2406: Cross-Site Scripting via Payment Method Title
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2392: Cross-Site Scripting via PageBuilder Banner
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2390: Broken authentication and session managememt
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2367: Remote code execution due to unsafe handling of a carrier gateway
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...