1702 matches found
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
CVE-2019-14273: Broken Access control on files
More info at https://www.silverstripe.org/download/security-releases/cve-2019-14273/...
CVE-2019-16409: Secureassets and versionedfiles modules can expose versions of protected files
More info at https://www.silverstripe.org/download/security-releases/cve-2019-16409/...
CVE-2019-14272: XSS in file titles managed through the CMS
More info at https://www.silverstripe.org/download/security-releases/cve-2019-14272/...
CVE-2019-12204: Missing warning on install.php on public webroot can lead to unauthenticated admin access
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12204/...
CVE-2019-12617: Access escalation for CMS users with limited access through permission cache pollution
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12617/...
CVE-2019-12203: Session fixation in "change password" form
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12203/...
CVE-2019-12245: Incorrect access control vulnerability in files uploaded to protected folders
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12245/...
CVE-2020-9280: Folders migrated from 3.x may be unsafe to upload to
More info at https://www.silverstripe.org/download/security-releases/cve-2020-9280/...
Circumvents open_basedir INI directive
ADVISORY: This release circumvents openbasedir in the requestinithook. If you rely on the openbasedir INI directive, we highly recommended you upgrade to 0.30.2. Fixed Shutdown span flushing blocking the process when forked 493 Memory access errors in cases when PHP code was run after extension...
Circumvents open_basedir INI directive
ADVISORY: This release circumvents openbasedir in the requestinithook. If you rely on the openbasedir INI directive, we highly recommended you upgrade to 0.30.2. Fixed - Shutdown span flushing blocking the process when forked 493 - Memory access errors in cases when PHP code was run after extensi...
EZSA-2019-006 Rules to disable executable access are ignored on Platform.sh (eZ Cloud)
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-006-rules-to-disable-executable-access-are-ignored-on-platform.sh-ez-cloud...
EZSA-2019-007 Prevent accepting app.php in URL in Platform.sh
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-007-prevent-accepting-app.php-in-url-in-platform.sh...
Exposed suppressed username via Special:Redirect
More info at https://phabricator.wikimedia.org/T230402...
Critical - Access bypass
More info at https://www.drupal.org/sa-core-2019-008...
Critical - Access bypass
More info at https://www.drupal.org/sa-core-2019-008...
Vulnerability to bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...
Vulnerability to bypass two-factor authentication with unverified JWT trusted device token
Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication. Please either disable the trusted feature in your application or upgrade to a bundle...
EZSA-2019-005 Bundled jQuery affected by CVE-2019-11358
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-005-bundled-jquery-affected-by-cve-2019-11358...
XXE Vulnerability
This is: - a bugfix - a new feature - X security Checklist: - X Changes are covered by unit tests - X Code style is respected - X Commit message explains why the change is made see https://github.com/erlang/otp/wiki/Writing-good-commit-messages - X CHANGELOG.md contains a short summary of the...
EZSA-2019-004 CSRF token in login form is disabled by default
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
Broken Access Control in Import Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-017...
Possible deserialization side-effects in symfony/cache
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...
Possible deserialization side-effects in symfony/cache
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-016...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-020...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Arbitrary Code Execution and Cross-Site Scripting in Backend API
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-019...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Security Misconfiguration in Frontend Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-015...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-015...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
Information Disclosure in Backend User Interface
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-014...
PRODSECBUG-2273: Sensitive data disclosure though malicious email templates
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2349: Arbitrary code execution via file upload in admin import feature
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2351: Arbitrary code execution via crafted sitemap creation
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2353: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2363: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2343: Insecure Direct Object Reference (IDOR) vulnerability can lead to deletion of downloadable products folder
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2345: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2347: Insufficient brute-forcing defenses in the token exchange protocol could be abused in carding attacks
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2375: Arbitrary code execution via malicious XML layouts
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2387: Cross site request forgery attacks are possible via the gift card removal feature
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2346: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2270: Reflected cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2275: Unsafe functionality is exposed via email templates manipulation
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...