1709 matches found
Security Misconfiguration Vulnerability in the AWS SDK for PHP
SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. Aws\Ec2 - Added support for...
Security Misconfiguration Vulnerability in the AWS SDK for PHP
SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. - Aws\Ec2 - Added support for...
Insecure state generation
More info at https://github.com/laravel/socialite/pull/91...
class yii\web\ViewAction allowed to include arbitrary files that end with .php
More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...
class yii\web\ViewAction allowed to include arbitrary files that end with .php
More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Cross-Site Scripting in 3rd party library Flowplayer
More info at https://typo3.org/security/advisory/typo3-core-sa-2015-007...
Brute Force Protection Bypass in backend login
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...
Frontend login Session Fixation
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003/...
Cross-Site Scripting exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-004/...
Information Disclosure possibility exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/...
Access bypass when editing file metadata
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...
Potential XSS and Open Redirect vectors in zend-diactoros
More info at https://framework.zend.com/security/advisory/ZF2015-05...
SS-2015-013: X-Forwarded-Host request hostname injection
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...
SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...
Denial of Service attack through XML payloads
More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...
CVE-2015-4050: ESI unauthorized access
More info at https://symfony.com/cve-2015-4050...
CVE-2015-4050: ESI unauthorized access
More info at https://symfony.com/cve-2015-4050...
SS-2015-012: External redirection risk in Security?ReturnURL
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-012/...
SS-2015-011: Potential SQL Injection Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
Exploit in the private channel authentication
More info at https://blog.pusher.com/update-on-security/...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...
Incorrect CSRF validation
More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
Potential CRLF injection attacks in mail and HTTP headers
More info at https://framework.zend.com/security/advisory/ZF2015-04...
XXE Vulnerability
Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...
User authentication bypass
More info at https://thelia.net/version-2-1-3-with-security-fix...
Esi Code Injection
More info at https://symfony.com/cve-2015-2308...
Unsafe methods in the Request class
More info at https://symfony.com/cve-2015-2309...
Unsafe methods in the Request class
More info at https://symfony.com/cve-2015-2309...
Esi Code Injection
More info at https://symfony.com/cve-2015-2308...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...
Critical vulnerabilities in JSON Web Token libraries
More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...
Privilege Escalation in TYPO3 Neos
More info at https://www.neos.io/blog/neos-sa-2015-001.html...
Privilege Escalation in TYPO3 Neos
More info at https://www.neos.io/blog/neos-sa-2015-001.html...
SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled
More info at https://www.silverstripe.org/download/security-releases/ss-2016-014/...
SS-2016-011: ChangePasswordForm does not check Member::canLogIn()
More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...
SS-2016-015: XSS In OptionsetField and CheckboxSetField
More info at https://www.silverstripe.org/download/security-releases/ss-2016-015/...
SS-2016-008: Password encryption salt expiry
More info at https://www.silverstripe.org/download/security-releases/ss-2016-008/...
SS-2016-012: Missing ACL on reports
More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...