1802 matches found
Multiple CRLF injection vulnerabilities
This release contains an important security update. Security update Takeshi Terada discovered that PHPMailer accepted addresses containing line breaks. This is valid in RFC5322, but allowing such addresses resulted in invalid RFC5321 SMTP commands, permitting a kind of message injection attack...
Multiple CRLF injection vulnerabilities
This release contains an important security update. Security update Takeshi Terada discovered that PHPMailer accepted addresses containing line breaks. This is valid in RFC5322, but allowing such addresses resulted in invalid RFC5321 SMTP commands, permitting a kind of message injection attack...
XSS attack vector in Security Library method xss_clean()
More info at https://www.codeigniter.com/userguide/changelog.htmlversion-3-0-3...
XSS attack vector in Security Library method xss_clean()
More info at https://www.codeigniter.com/userguide/changelog.htmlversion-3-0-3...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Filesystem Permissions Issues in Multiple Components
More info at https://framework.zend.com/security/advisory/ZF2015-07...
Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
More info at https://framework.zend.com/security/advisory/ZF2015-08...
SS-2015-016: XSS in install.php
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-016/...
SS-2015-017: Forum Module CSRF Vulnerability
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-017/...
SS-2015-015: XSS in dev/build returnURL Parameter
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-015/...
Backend: Non-Persistent Cross-Site Scripting
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-009/...
Frontend: Unauthenticated Path Disclosure
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-008/...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
SS-2015-018: File upload exposure on UserForms module
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-018/...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Security Misconfiguration Vulnerability in various Doctrine projects
More info at https://www.doctrine-project.org/2015/08/31/securitymisconfigurationvulnerabilityinvariousdoctrineprojects.html...
Remote code execution in templates
More info at https://symfony.com/blog/security-release-twig-1-20-0...
Direct access of prefixed controller actions
More info at https://bakery.cakephp.org/2015/08/06/cakephp2592610272released.html...
XXE/XEE vector when using ZendXml on multibyte payloads
More info at https://framework.zend.com/security/advisory/ZF2015-06...
XXE/XEE vector when using ZendXml on multibyte payloads
More info at https://framework.zend.com/security/advisory/ZF2015-06...
XXE/XEE vector when using ZendXml on multibyte payloads
More info at https://framework.zend.com/security/advisory/ZF2015-06...
State guessing vulnerability
By doing this we're protecting against people trying to guess the state...
Critical SQL injection bug in the ODBC database driver
More info at https://forum.codeigniter.com/thread-65803.html...
Security Misconfiguration Vulnerability in the AWS SDK for PHP
SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. - Aws\Ec2 - Added support for...
Security Misconfiguration Vulnerability in the AWS SDK for PHP
SECURITY FIX: This release addresses a security issue associated with CVE-2015-5723, specifically, fixes improper default directory umask behavior that could potentially allow unauthorized modifications of PHP code. Thanks to @ryan-lane for the initial report. Aws\Ec2 - Added support for...
Insecure state generation
More info at https://github.com/laravel/socialite/pull/91...
class yii\web\ViewAction allowed to include arbitrary files that end with .php
More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...
class yii\web\ViewAction allowed to include arbitrary files that end with .php
More info at https://www.yiiframework.com/news/87/yii-2-0-5-is-released-security-fix/...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Forced Redirect to External Website
More info at https://www.orocrm.com/blog/news/orocrm-security-announcement...
Cross-Site Scripting in 3rd party library Flowplayer
More info at https://typo3.org/security/advisory/typo3-core-sa-2015-007...
Frontend login Session Fixation
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-003/...
Information Disclosure possibility exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-005/...
Brute Force Protection Bypass in backend login
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-006/...
Cross-Site Scripting exploitable by Editors
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-004/...
Access bypass when editing file metadata
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-002/...
Potential XSS and Open Redirect vectors in zend-diactoros
More info at https://framework.zend.com/security/advisory/ZF2015-05...
SS-2015-013: X-Forwarded-Host request hostname injection
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...
SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-014/...
Denial of Service attack through XML payloads
More info at https://bakery.cakephp.org/2015/05/28/cakephp266and306released.html...
CVE-2015-4050: ESI unauthorized access
More info at https://symfony.com/cve-2015-4050...