Access bypass when editing file metadata

More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...

Potential XSS and Open Redirect vectors in zend-diactoros

More info at https://framework.zend.com/security/advisory/ZF2015-05...

SS-2015-013: X-Forwarded-Host request hostname injection

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...

SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...

Denial of Service attack through XML payloads

More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...

CVE-2015-4050: ESI unauthorized access

More info at https://symfony.com/cve-2015-4050...

CVE-2015-4050: ESI unauthorized access

More info at https://symfony.com/cve-2015-4050...

SS-2015-012: External redirection risk in Security?ReturnURL

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-012/...

SS-2015-011: Potential SQL Injection Vulnerability

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-011/...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Exploit in the private channel authentication

More info at https://blog.pusher.com/update-on-security/...

Exploit in the private channel authentication

More info at https://blog.pusher.com/update-on-security/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

More info at https://www.yiiframework.com/news/86/yii-2-0-4-is-released/...

Incorrect CSRF validation

More info at https://bakery.cakephp.org/2015/05/07/cakephp304released.html...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

Potential CRLF injection attacks in mail and HTTP headers

More info at https://framework.zend.com/security/advisory/ZF2015-04...

XXE Vulnerability

Security: XML filescan in XML-based Readers to prevent XML Entity Expansion XEE see http://projects.webappsec.org/w/page/13247002/XML%20Entity%20Expansion for an explanation of XEE injection attacks...

User authentication bypass

More info at https://thelia.net/version-2-1-3-with-security-fix...

Unsafe methods in the Request class

More info at https://symfony.com/cve-2015-2309...

Esi Code Injection

More info at https://symfony.com/cve-2015-2308...

Unsafe methods in the Request class

More info at https://symfony.com/cve-2015-2309...

Esi Code Injection

More info at https://symfony.com/cve-2015-2308...

Critical vulnerabilities in JSON Web Token libraries

More info at https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/...

Critical vulnerabilities in JSON Web Token libraries

More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...

Privilege Escalation in TYPO3 Neos

More info at https://www.neos.io/blog/neos-sa-2015-001.html...

Privilege Escalation in TYPO3 Neos

More info at https://www.neos.io/blog/neos-sa-2015-001.html...

SS-2016-013: Member.Name is not escaped

More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...

SS-2016-012: Missing ACL on reports

More info at https://www.silverstripe.org/download/security-releases/ss-2016-012/...

SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled

More info at https://www.silverstripe.org/download/security-releases/ss-2016-014/...

SS-2016-008: Password encryption salt expiry

More info at https://www.silverstripe.org/download/security-releases/ss-2016-008/...

SS-2016-011: ChangePasswordForm does not check Member::canLogIn()

More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...

SS-2016-015: XSS In OptionsetField and CheckboxSetField

More info at https://www.silverstripe.org/download/security-releases/ss-2016-015/...

SS-2015-010: XSS in Director::force_redirect()

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect/...

SS-2015-009: XSS In rewritten hash links

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-009-xss-in-rewritten-hash-links/...

SS-2014-015: IE requests not properly behaving with rewritehashlinks

More info at https://www.silverstripe.org/software/download/security-releases/ss-2014-015-ie-requests-not-properly-behaving-with-rewritehashlinks/...

SS-2015-008: SiteTree Creation Permission Vulnerability

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-008-sitetree-creation-permission-vulnerability/...

Invalid CSRF validation of null or incorrectly formatted token identifiers

More info at https://framework.zend.com/security/advisory/ZF2015-03...

Invalid CSRF validation of null or incorrectly formatted token identifiers

More info at https://framework.zend.com/security/advisory/ZF2015-03...

Critical vulnerabilities in JSON Web Token libraries

More info at https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/...

PHP object injection attack vulnerability in Slim.

https://github.com/slimphp/Slim/blob/master/Slim/Middleware/SessionCookie.phpL127 Generally, it's a bad idea to blindly unserialize user-controllable input. https://www.owasp.org/index.php/PHPObjectInjection EDIT - for people who don't want to read the whole thread: The SessionCookie class is not...

PHP object injection attack vulnerability in Slim.

https://github.com/slimphp/Slim/blob/master/Slim/Middleware/SessionCookie.phpL127 Generally, it's a bad idea to blindly unserialize user-controllable input. https://www.owasp.org/index.php/PHPObjectInjection EDIT - for people who don't want to read the whole thread: The SessionCookie class is not...

XSS injection in backoffice

More info at https://thelia.net/version-2-1-2-with-security-fix...

XSS injection in backoffice

More info at https://thelia.net/version-2-1-2-with-security-fix...

Attackers able to impersonate users

There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Hide comment For reference, this issue has been assigned ID CVE-2015-2964...

Attackers able to impersonate users

Merge branch 'disabling-none-by-default'...