1717 matches found
SUPEE-11086 - RCE, XSS, CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-11086...
XSS vulnerability with double-encoded entities
An XSS vulnerability CVE-2019-10010 has been identified in all previous versions of this library 0.18.2 and below. The issue has been fixed in version 0.18.3. All users should upgrade to version 0.18.3 immediately. Additionally, if your application caches the resulting HTML, please purge and/or...
Sandbox Information Disclosure
More info at https://symfony.com/blog/twig-sandbox-information-disclosure...
EZSA-2019-001 XSS in Admin UI
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui...
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
Changes form previous version All previous changes is here. - VD:abstract fix animated image conversion on ImageMagick - Security,VD:abstract CVE-2019-9194 fix command injection vulnerability of PHP connector Special thanks to Thomas Chauchefoin Synacktiv for reporting this vulnerability...
CVE-2019-5715: Reflected SQL Injection through Form and DataObject
More info at https://www.silverstripe.org/download/security-releases/ss-2018-021...
Retrieval of HTTP-only cookies
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
E-mail HTML injection
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Remote code execution
More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...
Cross-Site Scripting in Language Pack Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...
Cross-Site Scripting in Language Pack Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-004...
Arbitrary Code Execution via File List Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-008...
Arbitrary Code Execution via File List Module
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-008...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
Cross-Site Scripting in Form Framework
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-007...
Cross-Site Scripting in Bootstrap CSS toolkit
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...
Cross-Site Scripting in Bootstrap CSS toolkit
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...
Cross-Site Scripting in Fluid ViewHelpers
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...
Cross-Site Scripting in Fluid ViewHelpers
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-005...
Broken Access Control in Localization Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...
Broken Access Control in Localization Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-003...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
Information Disclosure of Installed Extensions
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-001...
CVE-2019-1000011: Access control bypass in GraphQL mutations
Q A Bug fix? yes New feature? no BC breaks? no Deprecations? no Tests pass? yes Fixed tickets 2364 License MIT Doc PR This prevents passing IRIs belonging to different resource classes, which would bypass access control in some instances see 2364...
CVE-2019-1000011: Access control bypass in GraphQL mutations
| Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | 2364 | License | MIT | Doc PR | This prevents passing IRIs belonging to different resource classes, which would bypass access control in some instances s...
XSS vulnerability with unsafe link protocols
An XSS vulnerability CVE-2018-20583 has been identified in the following versions of this library: 0.15.6 0.15.7 0.16.0 0.17.0 0.17.1 0.17.2 0.17.3 0.17.4 0.17.5 0.18.0 It allows unsafe URLs to be added to links. The issue has been fixed in version 0.18.1. All users should upgrade to version 0.18...
Potential RCE if filename starts with phar://
More info at https://pear.php.net/bugs/bug.php?id=23782...
Potential RCE if filename starts with phar://
More info at https://pear.php.net/bugs/bug.php?id=23782...
Credentials exposure in session storage
More info at https://simplesamlphp.org/security/201812-01...
Denial of service
Make the world a bit safer...
Denial of service
Make the world a bit safer...
SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector
More info at https://www.silverstripe.org/download/security-releases/ss-2018-020/...
SS-2018-019: Possible denial of service attack vector when flushing
More info at https://www.silverstripe.org/download/security-releases/ss-2018-019/...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
Information Disclosure in Install Tool
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...
Security Misconfiguration in Install Tool Cookie
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-009...
Cross-Site Scripting in Frontend User Login
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
Cross-Site Scripting in CKEditor
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-005...
Cross-Site Scripting in CKEditor
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-005...
Denial of Service in Frontend Record Registration
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...
Denial of Service in Online Media Asset Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-011...
Information Disclosure in Install Tool
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-010...