1709 matches found
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-009/...
Unauthenticated Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1918.html...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe In most versions of PHP, it lies about being secure And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: Release a new version v1.3.0 or most likely v2.0.0 that doesn't rely...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe - In most versions of PHP, it lies about being secure - And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: - Release a new version v1.3.0 or most likely v2.0.0 that...
Information leakage issue in the sanitycheck module
More info at https://simplesamlphp.org/security/201603-01...
Cross-Site Scripting in TYPO3 component CSS styled content
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-007/...
XML External Entity (XXE) Processing in TYPO3 Core
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-005/...
Cross-Site Scripting in TYPO3 component Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/...
Denial of Service attack possibility in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-008/...
SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers
More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...
SS-2015-028: Missing security check on dev/build/defaults
More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...
SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter
More info at https://www.silverstripe.org/download/security-releases/ss-2016-002/...
Cross-Site Scripting in form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-004/...
Cross-Site Scripting in legacy form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-003/...
SQL Injection in dbal
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-016/...
Cross-Site Scripting in link validator component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-002/...
Form API ignores access restrictions on submit buttons
More info at https://www.drupal.org/SA-CORE-2016-001...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
Session data truncation can lead to unserialization of user provided data
More info at https://www.drupal.org/SA-CORE-2016-001...
Brute force amplification attacks via XML-RPC
More info at https://www.drupal.org/SA-CORE-2016-001...
Form API ignores access restrictions on submit buttons
More info at https://www.drupal.org/SA-CORE-2016-001...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-001...
Email address can be matched to an account
More info at https://www.drupal.org/SA-CORE-2016-001...
HTTP header injection using line breaks
More info at https://www.drupal.org/SA-CORE-2016-001...
Reflected file download vulnerability
More info at https://www.drupal.org/SA-CORE-2016-001...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-001...
Reflected file download vulnerability
More info at https://www.drupal.org/SA-CORE-2016-001...
Email address can be matched to an account
More info at https://www.drupal.org/SA-CORE-2016-001...
Session data truncation can lead to unserialization of user provided data
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via double-encoded 'destination' parameter
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via path manipulation
More info at https://www.drupal.org/SA-CORE-2016-001...
File upload access bypass and denial of service
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via double-encoded 'destination' parameter
More info at https://www.drupal.org/SA-CORE-2016-001...
Brute force amplification attacks via XML-RPC
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via path manipulation
More info at https://www.drupal.org/SA-CORE-2016-001...
File upload access bypass and denial of service
More info at https://www.drupal.org/SA-CORE-2016-001...
Composer Cache Injection vulnerability
More info at http://flyingmana.de/blogen/2016/02/14/composercacheinjectionvulnerabilitycve20158371.html...
Composer Cache Injection vulnerability
More info at http://flyingmana.de/blogen/2016/02/14/composercacheinjectionvulnerabilitycve20158371.html...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
More info at https://symfony.com/cve-2016-1902...
Local File Disclosure
SECURITY Fix CVE-2017-5223, local file disclosure vulnerability if content passed to msgHTML is sourced from unfiltered user input. Reported by Yongxiang Li of Asiasecurity. The fix for this means that calls to msgHTML without a $basedir will not import images with relative URLs, and relative...
Multiple Cross-Site Scripting vulnerabilities in frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-013/...
TYPO3 is susceptible to Cross-Site Flashing
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-014/...
Cross-Site Scripting in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-015/...
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-011/...
Cross-Site Scripting vulnerability in typolinks
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/...
Remote Code Execution Vulnerability
More info at https://developer.joomla.org/security-centre/637-20151205-session-remote-code-execution-vulnerability.html...
Remote Code Execution (complement of CVE-2014-2383)
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...
Denial Of Service Vector
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...