1802 matches found
Unexpected bindings in QueryBuilder
This is a follow-up to the previous security advisory GHSA-3p32-j457-pg5x which addresses a few additional edge cases. If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the quer...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
SQL injection relating to searching
More info at https://www.phpmyadmin.net/security/PMASA-2020-3/...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released...
Unexpected bindings in QueryBuilder
More info at https://blog.laravel.com/security-laravel-62011-7302-8221-released https://blog.laravel.com/security-laravel-62012-7303-released...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
Disclosure of files via logo_path query parameter
Require version that checks mime type...
SQL injection in user accounts page
More info at https://www.phpmyadmin.net/security/PMASA-2020-1/...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insert tag injection in the login module
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
Insecure Deserialization in Query Generator & Query View
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-026...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
SQL Injection in low-level Query Generator
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-025...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Directory Traversal on ZIP extraction
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-024...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Filelist Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-023...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Link Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-022...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Cross-Site Scripting in Form Framework validation handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-021...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible Insecure Deserialization in Extbase Request Handling
More info at https://typo3.org/security/advisory/typo3-psa-2019-011...
Possible to circumvent title-blacklist
More info at https://phabricator.wikimedia.org/T239466...
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
More info at https://symfony.com/cve-2019-18888...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
CVE-2019-11325: Fix escaping of strings in VarExporter
More info at https://symfony.com/cve-2019-11325...
Critical signature bypass
More info at https://simplesamlphp.org/security/201911-01...
PRODSECBUG-2485: Information Disclosure via File upload functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2484: Arbitrary file deletion through export data data transfer
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2445: Insufficient logging and monitoring of configuration changes
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2449: Remote code execution via local file delete and XSLT injection
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2448: Cross side scripting via admin panel dashboard
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2424: SQL injection when accessing group data in email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2422: Cross-Site Scripting via Email Template Name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2423: Cross-Site Scripting via inventory source
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2447: Using JS libraries with known security vulnerabilities
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2444: Missing logs of configuration changes related to design update
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2440: Information disclosure through processing of external XML entities
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2426: Cross-Site Scripting via store name
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2434: SQL injection in 'Catalog Products List' widget leading to privilege escalation
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2425: Cross-Site Scripting via Signifyd Guarantee Option Translation Override
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2494: Arbitrary file deletion through design layout update
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2489: Cross side scripting during the preview of email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2419: Bypass of sitemp access restrictions
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...
PRODSECBUG-2417: Remote code execution via vulnerable Symphony dependecy injection
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...