1802 matches found
HTTP Proxy header vulnerability
Bug Fixes - Removed support for using HTTPPROXY environment variable for non-CLI apps per CVE-2016-5385 httpoxy. Graham Campbell 143 145 - Convert BUGSNAGNOTIFYRELEASESTAGES to a comma-delimited array Jason Graham Campbell 142 144...
HTTP Proxy header vulnerability
More info at https://twitter.com/asyncphp/status/755136084917583872...
Drupal Core - Highly Critical - Injection - SA-CORE-2016-003
More info at https://www.drupal.org/SA-CORE-2016-003...
Drupal Core - Highly Critical - Injection - SA-CORE-2016-003
More info at https://www.drupal.org/SA-CORE-2016-003...
HTTP Proxy header vulnerability
Addressing HTTPPROXY security vulnerability, CVE-2016-5385: https://httpoxy.org/. Please update to this version of Guzzle in order to mitigate the vulnerability when sending Guzzle requests inside of a CGI application. - Fixing timeout bug with StreamHandler - Only read up to Content-Length in...
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
More info at https://contao.org/en/news/contao-3515.html...
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
More info at https://contao.org/en/news/contao-3515.html...
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
More info at https://contao.org/en/news/contao-3515.html...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-021...
Cache Flooding in TYPO3 Frontend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-022...
Potential SQL injection in ORDER and GROUP statements of Zend_Db_Select
More info at https://framework.zend.com/security/advisory/ZF2016-02...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-002...
Views can allow unauthorized users to see Statistics information
More info at https://www.drupal.org/SA-CORE-2016-002...
Views can allow unauthorized users to see Statistics information
More info at https://www.drupal.org/SA-CORE-2016-002...
Saving user accounts can sometimes grant the user all roles
More info at https://www.drupal.org/SA-CORE-2016-002...
Link injection
More info at https://simplesamlphp.org/security/201606-01...
Missing Access Check in TYPO3 CMS
More info at https://typo3.org/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/missing-access-check-in-typo3-cms/...
SS-2016-005: Brute force bypass on default admin
More info at https://www.silverstripe.org/download/security-releases/ss-2016-005/...
SS-2016-004: XSS in CMS Edit Page
More info at https://www.silverstripe.org/download/security-releases/ss-2016-004/...
SS-2016-006: Missing CSRF protection in login form
More info at https://www.silverstripe.org/download/security-releases/ss-2016-006/...
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
More info at https://symfony.com/cve-2016-2403...
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
More info at https://symfony.com/cve-2016-2403...
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
More info at https://symfony.com/cve-2016-2403...
CVE-2016-4423: Large username storage in session
More info at https://symfony.com/cve-2016-4423...
CVE-2016-4423: Large username storage in session
More info at https://symfony.com/cve-2016-4423...
CVE-2016-4423: Large username storage in session
More info at https://symfony.com/cve-2016-4423...
Potential Insufficient Entropy Vulnerability in ZF1
More info at https://framework.zend.com/security/advisory/ZF2016-01...
Cross-Site Scripting in TYPO3 Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-009/...
Arbitrary File Disclosure in Form Component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-010/...
Authentication Bypass in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-011/...
Privilege Escalation in TYPO3 CMS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-012/...
Unauthenticated Remote Code Execution Vulnerability
More info at https://community.shopware.com/detail1918.html...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe In most versions of PHP, it lies about being secure And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: Release a new version v1.3.0 or most likely v2.0.0 that doesn't rely...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe - In most versions of PHP, it lies about being secure - And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: - Release a new version v1.3.0 or most likely v2.0.0 that...
Information leakage issue in the sanitycheck module
More info at https://simplesamlphp.org/security/201603-01...
Cross-Site Scripting in TYPO3 component Backend
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/...
Cross-Site Scripting in TYPO3 component CSS styled content
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-007/...
Denial of Service attack possibility in TYPO3 component Indexed Search
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-008/...
XML External Entity (XXE) Processing in TYPO3 Core
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-005/...
SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers
More info at https://www.silverstripe.org/download/security-releases/ss-2016-003/...
SS-2015-028: Missing security check on dev/build/defaults
More info at https://www.silverstripe.org/download/security-releases/ss-2015-028/...
SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter
More info at https://www.silverstripe.org/download/security-releases/ss-2016-002/...
Cross-Site Scripting in form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-004/...
Cross-Site Scripting in legacy form component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-003/...
Cross-Site Scripting in link validator component
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-002/...
SQL Injection in dbal
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-016/...
Open redirect via path manipulation
More info at https://www.drupal.org/SA-CORE-2016-001...
Open redirect via path manipulation
More info at https://www.drupal.org/SA-CORE-2016-001...