$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'

More info at https://phabricator.wikimedia.org/T169545...

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment I'm afraid this change is wrong. fileexists is not the only...

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Fix for security vulnerability: Using the phar:// wrapper it was possible to trigger the unserialization of user provided data...

Magento 2.2.6 and 2.1.15 Security update

More info at https://magento.com/security/patches/magento-2.2.6-and-2.1.15-security-update...

SS-2018-016: Unsafe SQL Query Construction (Safe Data Source)

More info at https://www.silverstripe.org/download/security-releases/ss-2018-016/...

SS-2018-018: Database credentials disclosure during connection failure

More info at https://www.silverstripe.org/download/security-releases/ss-2018-018/...

SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension

More info at https://www.silverstripe.org/download/security-releases/ss-2018-017/...

Authentication Bypass in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-001...

Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-002...

Privilege Escalation & SQL Injection in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...

Insecure Deserialization in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...

Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-002...

Privilege Escalation & SQL Injection in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-003...

Insecure Deserialization in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-004...

Authentication Bypass in TYPO3 CMS

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-001...

CSRF vulnerability in the admin panel

More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...

CSRF vulnerability in the admin panel

More info at https://sylius.com/blog/csrf-vulnerability-in-admin-panel/...

When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information

More info at https://phabricator.wikimedia.org/T187638...

SUPEE-10752 - Multiple security enhancements vulnerabilities

More info at https://magento.com/security/patches/supee-10752...

Adminer script versions up to 4.6.2 contains file disclosure vulnerability

More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...

Adminer script versions up to 4.6.2 contains file disclosure vulnerability

More info at https://sansec.io/research/adminer-4.6.2-file-disclosure-vulnerability...

Magento 2.2.5 and 2.1.14 Security update

More info at https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

PHP Code Injection

phpWhois PHP Code Injection Vulnerability Overview phpWhois and some of its forks in versions before 5.1.0 are prone to a code injection vulnerability due to insufficient sanitization of returned WHOIS data. This allows attackers controlling the WHOIS information of a requested domain to execute...

PHP Code Injection

phpWhois PHP Code Injection\nVulnerability Overview\nphpWhois and some of its forks in versions before 5.1.0 are prone to a\ncode injection vulnerability due to insufficient sanitization of returned\nWHOIS data. This allows attackers controlling the WHOIS information of a\nrequested domain to...

CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password

More info at https://symfony.com/cve-2018-11407...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password

More info at https://symfony.com/cve-2018-11407...

CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password

More info at https://symfony.com/cve-2018-11407...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11408: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2018-11408...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11386: Denial of service when using PDOSessionHandler

More info at https://symfony.com/cve-2018-11386...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11386: Denial of service when using PDOSessionHandler

More info at https://symfony.com/cve-2018-11386...

CVE-2018-11408: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2018-11408...

SS-2018-006: Code execution vulnerability

More info at https://www.silverstripe.org/download/security-releases/ss-2018-006/...

SS-2018-010: Member disclosure in login form

More info at https://www.silverstripe.org/download/security-releases/ss-2018-010/...

SS-2018-012: Uploaded PHP script execution in assets

More info at https://www.silverstripe.org/download/security-releases/ss-2018-012/...

SS-2018-008: BackURL validation bypass with malformed URLs

More info at https://www.silverstripe.org/download/security-releases/ss-2018-008/...