1717 matches found
Cross-Site Scripting in Backend Modal Component
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-007...
Cross-Site Scripting in Online Media Asset Rendering
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-006...
SS-2018-007: CSRF vulnerability in graphql
More info at https://www.silverstripe.org/download/security-releases/ss-2018-007/...
Magento 2.2.7 and 2.1.16 Security update. Closes RCE,XSS and other vulnerabilities
More info at https://magento.com/security/patches/magento-2.2.7-and-2.1.16-security-update...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
SUPEE-10975 - Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities
More info at https://magento.com/security/patches/supee-10975...
XXE Vulnerability
This is: - X a bug report - a feature request - not a usage question ask them on https://stackoverflow.com/questions/tagged/phpspreadsheet or https://gitter.im/PHPOffice/PhpSpreadsheet What is the expected behavior? The securityScan function is used to prevent XXE attacks. What is the current...
XXE Vulnerability
This is: - X a bug report - a feature request - not a usage question ask them on https://stackoverflow.com/questions/tagged/phpspreadsheet or https://gitter.im/PHPOffice/PhpSpreadsheet What is the expected behavior? The securityScan function is used to prevent XXE attacks. What is the current...
EZSA-2018-007 User data disclosure
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...
CVE-2018-19790: Open Redirect Vulnerability on login
More info at https://symfony.com/cve-2018-19790...
CVE-2018-19789: Temporary uploaded file path disclosure
More info at https://symfony.com/cve-2018-19789...
CVE-2018-19790: Open Redirect Vulnerability on login
More info at https://symfony.com/cve-2018-19790...
CVE-2018-19789: Temporary uploaded file path disclosure
More info at https://symfony.com/cve-2018-19789...
CVE-2018-19790: Open Redirect Vulnerability on login
More info at https://symfony.com/cve-2018-19790...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
See https://twitter.com/CiPHPerCoder/status/1050427719941525504 for discussion...
EZSA-2018-009 Do not interpret PHP/PHAR uploads
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads...
Loading JS from user space where the username is not a registered account is dangerous and should be banned
More info at https://phabricator.wikimedia.org/T207603...
EZSA-2018-008 REST API returns list of all SiteAccesses
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-008-rest-api-returns-list-of-all-siteaccesses...
By-passing Protection of PharStreamWrapper Interceptor
More info at https://typo3.org/security/advisory/typo3-psa-2018-001...
EZSA-2018-006 XSS vulnerability in 'disabled module' error template
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template...
EZSA-2018-005 Passwordless login for LDAP users
More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users...
Action case insensitivity
Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...
Action case insensitivity
Fix security breach = required role for action was not required for Action nor ACTION. Thanks to [email protected]...
Potential enwiki DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
More info at https://phabricator.wikimedia.org/T204729...
1.31.0 tarball is missing .htaccess files
More info at https://phabricator.wikimedia.org/T199029...
$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
More info at https://phabricator.wikimedia.org/T169545...
$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
More info at https://phabricator.wikimedia.org/T169545...
BotPassword can bypass CentralAuth's account lock
More info at https://phabricator.wikimedia.org/T194605...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...
Magento 2.2.6 and 2.1.15 Security update
More info at https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update...
SS-2018-016: Unsafe SQL Query Construction (Safe Data Source)
More info at https://www.silverstripe.org/download/security-releases/ss-2018-016/...
SS-2018-018: Database credentials disclosure during connection failure
More info at https://www.silverstripe.org/download/security-releases/ss-2018-018/...
SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension
More info at https://www.silverstripe.org/download/security-releases/ss-2018-017/...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-001...
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-002...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-001...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-002...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
Privilege Escalation & SQL Injection in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...
Insecure Deserialization in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
CSRF vulnerability in the admin panel
More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...
When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information
More info at https://phabricator.wikimedia.org/T187638...