1773 matches found
PRODSECBUG-2132: Insecure Direct Object Reference (IDOR) vulnerability can expose sensitive company details
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2233: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2276: Insecure Direct Object Reference (IDOR) vulnerability can expose order shipping details
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2220: Deletion of store design schedule via cross-site request forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2430: Security bypass via crafted SOAP requests
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2182: Reflected cross-site scripting in the admin panel.
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2171: Insecure token implementation leads to Cross-Site Request Forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2301: Names of disabled products can be leaked due to inadequate validation checks
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2226: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2246: Stored cross-site scripting in the WYSIWYG editor
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2351: Arbitrary code execution via crafted sitemap creation
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2317: Stored cross-site scripting in admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2299: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2095: Defense-in-depth session validation check implemented
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
CVE-2019-12246: Denial of Service on flush and development URL tools
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12246...
CVE-2019-12437: Cross Site Request Forgery (CSRF) Protection Bypass in GraphQL
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12437...
CVE-2019-12149: Potential SQL injection in restfulserver and registry modules
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12149...
CVE-2019-12149: Potential SQL injection in restfulserver and registry modules
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12149...
Exposed suppressed log in RevisionDelete page
More info at https://phabricator.wikimedia.org/T222038...
Direct POST to Special:ChangeEmail will bypass reauth check
More info at https://phabricator.wikimedia.org/T197279...
Need to make a limit of count of attempts to change email address
More info at https://phabricator.wikimedia.org/T209794...
API responses for unpatrolled or (not) autopatrolled recent changes require privileges but may be cached publicly
More info at https://phabricator.wikimedia.org/T212118...
Forbid blocking IP ranges as big as /1 and /2, as done on ruwikiquote using the API
More info at https://phabricator.wikimedia.org/T199540...
Exposed suppressed username or log in Special:EditTags
More info at https://phabricator.wikimedia.org/T222036...
EZSA-2019-003 XSS in eZFind spellcheck
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-003-xss-in-ezfind-spellcheck...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2019-007...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2019-008...
Unsafe deserialization in SmtpTransport
More info at https://bakery.cakephp.org/2019/04/23/cakephp37736153518released.html...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. js:core Fixed 2863 cssAutoLoad Array option is not working js:core Fixed 2862 stop autoSync when browser tab turn to background cmd:search Fixed 2867 support incremental search other than filename VD:abstract Fixed 2873 correct MIME-Type...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. - js:core Fixed 2863 cssAutoLoad Array option is not working - js:core Fixed 2862 stop autoSync when browser tab turn to background - cmd:search Fixed 2867 support incremental search other than filename - VD:abstract Fixed 2873 correct...
Confirming an opt-in token does not invalidate previous opt-in tokens
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...
The CSRF token check can be bypassed
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10642.html...