1773 matches found
Remote Code Execution
$highlight = Pygmentize::highlight'?php phpinfo;', ';uname -a '; printr$highlight; This will produce the following output: Darwin Micheals-MBP 16.1.0 Darwin Kernel Version 16.1.0: Thu Oct 13 21:26:57 PDT 2016; root:xnu-3789.21.360/RELEASEX8664 x8664 The problem lines appear to be here:...
Cookie leakage to wrong origins and non-restricted cookie acceptance
Security and maintenance release. - Security: Previously cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax follows newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, b...
Authentication context bypass (multiauth module)
More info at https://simplesamlphp.org/security/201704-02...
Session fixation and authentication bypass (authcrypt module)
More info at https://simplesamlphp.org/security/201705-01...
Unauthenticated encryption in CBC mode
More info at https://simplesamlphp.org/security/201704-01...
Access bypass
More info at https://www.drupal.org/SA-2017-002...
Access bypass
More info at https://www.drupal.org/SA-2017-002...
Flow Bugfix Releases for Entity Security
More info at https://www.neos.io/blog/flow-bugfix-releases-for-entity-security.html...
Flow Bugfix Releases for Entity Security
More info at https://www.neos.io/blog/flow-bugfix-releases-for-entity-security.html...
Incorrect IV generation for encryption
More info at https://simplesamlphp.org/security/201703-02...
Multiple timing side-channel issues
More info at https://simplesamlphp.org/security/201703-01...
Editor module incorrectly checks access to inline private files
More info at https://www.drupal.org/SA-2017-001...
Some admin paths were not protected with a CSRF token
More info at https://www.drupal.org/SA-2017-001...
Editor module incorrectly checks access to inline private files
More info at https://www.drupal.org/SA-2017-001...
Remote code execution
More info at https://www.drupal.org/SA-2017-001...
Remote code execution
More info at https://www.drupal.org/SA-2017-001...
Some admin paths were not protected with a CSRF token
More info at https://www.drupal.org/SA-2017-001...
An error during signature verification can be treated as a successful verification.
…nse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature algorithm used. The opensslverify function returns 1 when the signature...
An error during signature verification can be treated as a successful verification.
Security update for signature validation on LogoutRequest/LogoutResponse. In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling opensslverify depending on the signature...
Authentication Bypass in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-002/...
Arbitrary shell execution
Security Advisory This release contains a fix for a security advisory related to the improper handling of shell commands Uses of shellexec and exec were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary co...
Arbitrary shell execution
Security Advisory - This release contains a fix for a security advisory related to the improper handling of shell commands - Uses of shellexec and exec were not escaping filenames and configuration settings in most cases - A properly crafted filename or configuration option would allow for...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
SUPEE-9652 - Remote Code Execution using mail vulnerability
More info at https://magento.com/security/patches/supee-9652...
Remote Code Execution in Qquoteadv/controllers/DownloadController.php
More info at https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction...
Remote Code Execution in Qquoteadv/controllers/DownloadController.php
More info at https://cart2quote.zendesk.com/hc/en-us/articles/115000616303--FIXED-Security-Vulnerability-in-downloadCustomOptionAction...
SS-2017-001: XSS In page name
More info at https://www.silverstripe.org/download/security-releases/ss-2017-001/...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1989.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Security fix for Flow Swift Mailer package
More info at https://www.neos.io/blog/flow-sa-2017-01.html...
Remote Code Execution in third party library swiftmailer
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-001/...
Cross-Site Scripting in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-003/...
Remote Code Execution when using the mail transport
More info at https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html...
Remote Code Execution
Important security update! This release patches the critical vulnerability described in CVE-2016-10045 a remote code execution vulnerability, responsibly reported by Dawid Golunski, and patched by Paul Buonopane @Zenexer. Possible side effect - complex sender addresses such as those used in VERP...
Remote Code Execution
SECURITY Critical security update for CVE-2016-10033 please update now! Thanks to Dawid Golunski. - Add ability to extract the SMTP transaction ID from some common SMTP success messages - Minor documentation tweaks...
Potential remote code execution in zend-mail via Sendmail adapter
More info at https://framework.zend.com/security/advisory/ZF2016-04...
Potential remote code execution in zend-mail via Sendmail adapter
More info at https://framework.zend.com/security/advisory/ZF2016-04...
Incorrect persistent NameID generation
More info at https://simplesamlphp.org/security/201612-04...
Incorrect signature verification
More info at https://simplesamlphp.org/security/201612-03...
Incorrect signature verification
More info at https://simplesamlphp.org/security/201612-02...
Incorrect signature verification
More info at https://simplesamlphp.org/security/201612-01...
Path Traversal in TYPO3 Core
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-024/...
Insecure Unserialize in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-023/...
SS-2016-016: XSS In CMSSecurity BackURL
More info at https://www.silverstripe.org/download/security-releases/ss-2016-016/...
SS-2016-010: ReadOnly transformation for formfields exploitable
More info at https://www.silverstripe.org/download/security-releases/ss-2016-010/...
Denial of service via transliterate mechanism
More info at https://www.drupal.org/SA-CORE-2016-005...