1769 matches found
PRODSECBUG-2182: Reflected cross-site scripting in the admin panel.
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2177: Insufficient server side validations leads to Insecure File upload vulnerability
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-1513: Insufficient brute force protections on promo code entry
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2307: Insufficient enforcement of user access controls can lead to unauthorized environment configuration changes
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2320: Arbitrary code execution due to unsafe handling of system configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2320: Arbitrary code execution due to unsafe handling of system configuration
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13...
PRODSECBUG-2127: Disclosure of Magento admin panel URL
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2132: Insecure Direct Object Reference (IDOR) vulnerability can expose sensitive company details
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2171: Insecure token implementation leads to Cross-Site Request Forgery (CSRF)
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33...
PRODSECBUG-2270: Reflected cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2190: Stored cross-site scripting in the admin panel
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
PRODSECBUG-2380: Stored cross-site scripting in the Currency Symbols field
More info at https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
Information Disclosure Security Note
More info at https://www.neos.io/blog/neos-workspace-disclosure-security.html...
CVE-2019-12246: Denial of Service on flush and development URL tools
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12246...
CVE-2019-12437: Cross Site Request Forgery (CSRF) Protection Bypass in GraphQL
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12437...
CVE-2019-12149: Potential SQL injection in restfulserver and registry modules
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12149...
CVE-2019-12149: Potential SQL injection in restfulserver and registry modules
More info at https://www.silverstripe.org/download/security-releases/cve-2019-12149...
Exposed suppressed log in RevisionDelete page
More info at https://phabricator.wikimedia.org/T222038...
Direct POST to Special:ChangeEmail will bypass reauth check
More info at https://phabricator.wikimedia.org/T197279...
Need to make a limit of count of attempts to change email address
More info at https://phabricator.wikimedia.org/T209794...
Forbid blocking IP ranges as big as /1 and /2, as done on ruwikiquote using the API
More info at https://phabricator.wikimedia.org/T199540...
API responses for unpatrolled or (not) autopatrolled recent changes require privileges but may be cached publicly
More info at https://phabricator.wikimedia.org/T212118...
Exposed suppressed username or log in Special:EditTags
More info at https://phabricator.wikimedia.org/T222036...
EZSA-2019-003 XSS in eZFind spellcheck
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-003-xss-in-ezfind-spellcheck...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in User Authentication
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-010...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Information Disclosure in Page Tree
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-009...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
Possible Arbitrary Code Execution in Image Processing
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-012...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Security Misconfiguration in User Session Handling
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
Cross-Site Scripting in Fluid Engine
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-013...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2019-007...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2019-008...
Unsafe deserialization in SmtpTransport
More info at https://bakery.cakephp.org/2019/04/23/cakephp37736153518released.html...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. js:core Fixed 2863 cssAutoLoad Array option is not working js:core Fixed 2862 stop autoSync when browser tab turn to background cmd:search Fixed 2867 support incremental search other than filename VD:abstract Fixed 2873 correct MIME-Type...
Fixed being bypassable of CVE-2019-6257 SSRF.
Changes form previous version All previous changes is here. - js:core Fixed 2863 cssAutoLoad Array option is not working - js:core Fixed 2862 stop autoSync when browser tab turn to background - cmd:search Fixed 2867 support incremental search other than filename - VD:abstract Fixed 2873 correct...
The CSRF token check can be bypassed
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10642.html...
Confirming an opt-in token does not invalidate previous opt-in tokens
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...
Confirming an opt-in token does not invalidate previous opt-in tokens
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10643.html...
The CSRF token check can be bypassed
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10642.html...
Existing sessions are not correctly invalidated when a user changes their password
More info at https://contao.org/en/news/security-vulnerability-cve-2019-10641.html...
EZSA-2019-002 Password reset vulnerability
More info at https://share.ez.no/community-project/security-advisories/ezsa-2019-002-password-reset-vulnerability...