1697 matches found
The ExtJS JavaScript framework that is shipped with TYPO3 is susceptible to XSS
More info at https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/...
Risk of mass-assignment vulnerabilities
More info at https://laravel.com/docs/5.3/upgradeupgrade-4.1.29...
Risk of mass-assignment vulnerabilities
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.29...
SecurityComponent cross form submission issue
More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...
SecurityComponent cross form submission issue
More info at https://bakery.cakephp.org/2014/04/29/CakePHP-1-3-18-and-2-4-8-released.html...
Authentication adapter did not verify validity of tokens
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...
Authentication adapter did not verify validity of tokens
Previous to @2ca5bb1c2f11537be8f94ca6867d8d69789e744a release 0.1.2, tokens weren't checked for validity/expiration. This potentially caused a security issue if expired tokens were not deleted after the expiration time was past, allowing anyone to still use invalidated authentication credentials...
Hijacked authentication cookies vulnerability
More info at https://laravel.com/docs/5.3/upgradeupgrade-4.1.26...
Hijacked authentication cookies vulnerability
More info at https://laravel.com/docs/5.1/upgradeupgrade-4.1.26...
Insufficient input validation allows for code injection and remote execution
More info at https://contao.org/en/news/new-security-hole-found-in-contao.html...
PHP remote file inclusion vulnerability in dompdf.php
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...
Arbitrary file read in dompdf
More info at https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/...
PHP remote file inclusion vulnerability in dompdf.php
This release is superseded by version 0.7.0 This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new docume...
XEE issue that could expose local files or easily trigger a DOS attack.
XXE security issue. Issue 414...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XSS vector in multiple view helpers
More info at https://framework.zend.com/security/advisory/ZF2014-03...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
PHP object injection vulnerability allows for arbitrary code execution
More info at https://contao.org/en/news/major-security-hole-found-in-contao.html...
Fixed issue with broken validation of JSONP callbacks
More info at https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler...
Cross-Site Scripting in TYPO3 Flow
More info at https://www.neos.io/blog/flow-sa-2013-001.html...
Cross-Site Scripting in TYPO3 Flow
More info at https://www.neos.io/blog/flow-sa-2013-001.html...
Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress
More info at https://framework.zend.com/security/advisory/ZF2013-04...
Possible DOS attack with long user-submitted passwords
More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...
Possible DOS attack with long user-submitted passwords
More info at https://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released...
Request::getHost() poisoning
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
Request::getHost() poisoning
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
Validation metadata serialization and loss of information
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
Validation metadata serialization and loss of information
More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...
XML External Entity (XXE) issue
thanks to Kousuke Ebihara for the report and patch...
XML External Entity (XXE) issue
disable external XML entities and libxml errors thanks to Kousuke Ebihara for the report and patch...
Authentication Vulnerability - possible attempt to login via zero-valued password credential
Security advisory: zero-valued authentication credentials vulnerability DoctrineModule version 0.7.2 has been just released and includes a security fix for 248 via @5f79a9f7b and @78018ef568, Affected versions All versions below 0.7.2 are affected. dev-master and 0.8.x are not affected starting...
Local file exposure on Windows installations
More info at https://groups.google.com/forum/?fromgroups=!topic/sabredav-discuss/ehOUu7wTSGQ...
Local file exposure on Windows installations
More info at https://groups.google.com/forum/?fromgroups=!topic/sabredav-discuss/ehOUu7wTSGQ...
Vulnerability in the filesystem loader
More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...
Vulnerability in the filesystem loader
More info at http://blog.twig.sensiolabs.org/post/47461911874/security-release-twig-1-12-3-released...
Potential Information Disclosure and Insufficient Entropy vulnerabilities in Zend\Math\Rand and Zend\Validate\Csrf Components
More info at https://framework.zend.com/security/advisory/ZF2013-02...
Potential SQL injection due to execution of platform-specific SQL containing interpolations
More info at https://framework.zend.com/security/advisory/ZF2013-03...
Route Parameter Injection Via Query String in Zend\Mvc
More info at https://framework.zend.com/security/advisory/ZF2013-01...
Ability to enable/disable object support in YAML parsing and dumping
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
Ability to enable/disable object support in YAML parsing and dumping
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
Ability to enable/disable PHP parsing in Yaml::parse()
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
Ability to enable/disable PHP parsing in Yaml::parse()
More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...
Code execution vulnerability via the "internal" routes
More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...