1802 matches found
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...
XSS vulnerabililty in the front end "unsubscribe" module of the newsletter extension
More info at https://contao.org/en/news/contao-3532.html...
Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air.
Bugfixes Fixed a security issue discovered by @hernandev that enabled an attacker to impersonate any registered user in a Firebase application...
Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air.
Bugfixes Fixed a security issue discovered by @hernandev that enabled an attacker to impersonate any registered user in a Firebase application...
The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity
More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...
The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity
More info at https://www.yiiframework.com/news/165/yii-2-0-14-is-released/...
SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-010/...
SS-2017-007: CSV Excel Macro Injection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-007/...
SS-2017-008: SQL injection in full text search of SilverStripe 4
More info at https://www.silverstripe.org/download/security-releases/ss-2017-008/...
SS-2017-006: Session user agent change detection
More info at https://www.silverstripe.org/download/security-releases/ss-2017-006/...
SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt
More info at https://www.silverstripe.org/download/security-releases/ss-2017-009/...
CVE-2017-16654: Intl bundle readers breaking out of paths
More info at https://symfony.com/cve-2017-16654...
CVE-2017-16654: Intl bundle readers breaking out of paths
More info at https://symfony.com/cve-2017-16654...
CVE-2017-16790: Ensure that submitted data are uploaded files
More info at https://symfony.com/cve-2017-16790...
CVE-2017-16652: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2017-16652...
CVE-2017-16652: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2017-16652...
CVE-2017-16652: Open redirect vulnerability on security handlers
More info at https://symfony.com/cve-2017-16652...
CVE-2017-16790: Ensure that submitted data are uploaded files
More info at https://symfony.com/cve-2017-16790...
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
More info at https://symfony.com/cve-2017-16653...
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
More info at https://symfony.com/cve-2017-16653...
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
More info at https://symfony.com/cve-2017-16653...
SQL injection vulnerabililty in the front end listing module
More info at https://contao.org/en/news/contao-448.html...
SQL injection vulnerabililty in the back end search filter and the front end listing module
More info at https://contao.org/en/news/contao-3531.html...
SQL injection vulnerabililty in the back end search filter
More info at https://contao.org/en/news/contao-448.html...
SQL injection vulnerabililty in the back end search filter
More info at https://contao.org/en/news/contao-448.html...
Arbitrary code execution via a crafted email address
More info at https://github.com/zetacomponents/Mail/issues/58...
Arbitrary code execution via a crafted email address
More info at https://github.com/zetacomponents/Mail/issues/58...
XSS in class documenting_xmlrpc_server
More info at https://github.com/gggeek/phpxmlrpc-extras/releases/tag/0.6.1...
Signature validation bypass (SAML 1.1)
More info at https://simplesamlphp.org/security/201710-01...
SS-2017-005: User enumeration via timing attack on login and password reset forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...
XSS in the url field on the password workspace grid and sidebar
More info at https://www.passbolt.com/incidents/20170914xssonresourceurls...
Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-005/...
Cross-Site Scripting in TYPO3 CMS Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-004/...
Information Disclosure in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-006/...
Cross Site Scripting (XSS) in the consentAdmin module
More info at https://simplesamlphp.org/security/201709-01...
EZSA-2017-006 Information disclosure in backend content tree menu
More info at http://share.ez.no/community-project/security-advisories/ezsa-2017-006-information-disclosure-in-backend-content-tree-menu...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
Views does not properly restrict access to the Ajax endpoint.
More info at https://www.drupal.org/SA-CORE-2017-004...
REST API can bypass comment approval.
More info at https://www.drupal.org/SA-CORE-2017-004...
Entity access bypass for entities that do not have UUIDs or have protected revisions.
More info at https://www.drupal.org/SA-CORE-2017-004...
Entity access bypass for entities that do not have UUIDs or have protected revisions.
More info at https://www.drupal.org/SA-CORE-2017-004...
REST API can bypass comment approval.
More info at https://www.drupal.org/SA-CORE-2017-004...
XSS vulnerability in code example
SECURITY Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There...
Object injection
SECURITY Fix potential object injection vulnerability. CVE-2018-19296. Reported by Sehun Oh of cyberone.kr. Added Tagalog translation, thanks to @StoneArtz Added Malagache translation, thanks to @Hackinet Updated Serbian translation, fixed incorrect language code, thanks to @mmilanovic4 Updated...
CVE-2017-11365: Empty passwords validation issue
More info at https://symfony.com/cve-2017-11365...
CVE-2017-11365: Empty passwords validation issue
More info at https://symfony.com/cve-2017-11365...
CVE-2017-11365: Empty passwords validation issue
More info at https://symfony.com/cve-2017-11365...