Advisories

Listing reported advisories sorted by their report date.

CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
FriendsOfPHP

symfony/security

>=3.3.0, <3.3.17 · >=2.8.0, <2.8.37 · >=4.0.0, <4.0.7 · >=3.4.0, <3.4.7 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-05-25 14:04:47
CVE-2018-11385: Session Fixation Issue for Guard Authentication
FriendsOfPHP

symfony/symfony

>=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=2.7.0, <2.7.48 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-05-25 14:04:47
CVE-2018-11386: Denial of service when using PDOSessionHandler
FriendsOfPHP

symfony/symfony

>=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=2.7.0, <2.7.48 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-05-25 14:04:47
CVE-2018-11406: CSRF Token Fixation
FriendsOfPHP

symfony/symfony

>=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=2.7.0, <2.7.48 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-05-25 14:04:47
CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
FriendsOfPHP

symfony/symfony

>=3.3.0, <3.3.17 · >=2.8.0, <2.8.37 · >=4.0.0, <4.0.7 · >=3.4.0, <3.4.7 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-05-25 14:04:47
CVE-2018-11408: Open redirect vulnerability on security handlers
FriendsOfPHP

symfony/symfony

>=2.7.38, <2.7.48 · >=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-05-25 14:04:47
SS-2018-001: Privilege Escalation Risk in Member Edit form
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.0, <4.0.4 · >=3.6.0, <3.6.6 · >=3.5.7, <3.5.8

2018-05-24 16:49:48
SS-2018-005: isDev and isTest unguarded
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.0, <4.0.4

2018-05-24 16:49:48
SS-2018-006: Code execution vulnerability
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.3, <4.0.4

2018-05-24 16:49:48
SS-2018-008: BackURL validation bypass with malformed URLs
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.0, <4.0.4

2018-05-24 16:49:48
SS-2018-010: Member disclosure in login form
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.0, <4.0.4

2018-05-24 16:49:48
SS-2018-012: Uploaded PHP script execution in assets
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.0, <4.0.4

2018-05-24 16:49:48
SS-2018-014: Dangerous file types in allowed upload
FriendsOfPHP

silverstripe/framework

>=4.1.0, <4.1.1 · >=4.0.3, <4.0.4 · >=3.6.5, <3.6.6

2018-05-24 16:49:48
SS-2018-004: XSS Vulnerability via WYSIWYG editor
FriendsOfPHP

silverstripe/admin

>=1.1.0, <1.1.1 · >=1.0.3, <1.0.4

2018-05-24 15:23:52
XSS in some development error pages
FriendsOfPHP

cakephp/cakephp

>=3.5.0, <3.5.17 · >=3.4.0, <3.4.14 · >=3.6.0, <3.6.4

2018-05-20 22:08:00
Trusted-Directory Bypass via Path Traversal
FriendsOfPHP

smarty/smarty

<3.1.33

2018-04-26 19:38:08
Trusted-Directory Bypass via Path Traversal
FriendsOfPHP

smarty/smarty

<3.1.33

2018-04-26 19:38:08
Critical - Remote Code Execution
FriendsOfPHP

drupal/core

>=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.5, <8.5.3 · >=8.4, <8.4.8 · >=8.0, <8.1.0 · >=7.0, <7.59

2018-04-25 16:39:00
Critical - Remote Code Execution
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.5, <8.5.3 · >=8.4, <8.4.8 · >=8.0, <8.1.0 · >=7.0, <7.59

2018-04-25 16:39:00
Moderately critical - Cross Site Scripting
FriendsOfPHP

drupal/core

>=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.5, <8.5.2 · >=8.4, <8.4.7 · >=8.0, <8.1.0

2018-04-18 17:53:00
Moderately critical - Cross Site Scripting
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.5, <8.5.2 · >=8.4, <8.4.7 · >=8.0, <8.1.0

2018-04-18 17:53:00
Cross-site scripting (XSS) vulnerability in the system log of the back end
FriendsOfPHP

contao/core

>=3.0.0, <3.5.35

2018-04-18 09:51:00
Cross-site scripting (XSS) vulnerability in the system log of the back end
FriendsOfPHP

contao/contao

>=4.0.0, <4.4.18 · >=4.5.0, <4.5.8

2018-04-18 09:29:00
Cross-site scripting (XSS) vulnerability in the system log of the back end
FriendsOfPHP

contao/core-bundle

>=4.0.0, <4.4.18 · >=4.5.0, <4.5.8

2018-04-18 09:29:00
Information disclosure of source code
FriendsOfPHP

simplesamlphp/simplesamlphp

<1.18.6

2018-04-17 07:15:00
Crypt encryption compromised.
FriendsOfPHP

fuel/core

<1.8.1

2018-04-16 17:23:00
Exploit of encryption failure vulnerability
FriendsOfPHP

illuminate/encryption

>=5.4.0, <=5.4.36 · >=5.3.0, <=5.3.31 · >=5.2.0, <=5.2.45 · >=5.1.0, <=5.1.46 · >=5.0.0, <=5.0.35 · >=4.2.0, <=4.2.22 · >=4.1.0, <=4.1.31 · >=4.0.0, <=4.0.11 · >=5.6.0, <5.6.15 · >=5.5.0, <5.5.40

2018-03-30 13:26:38
Exploit of encryption failure vulnerability
FriendsOfPHP

laravel/framework

>=5.4.0, <=5.4.36 · >=5.3.0, <=5.3.31 · >=5.2.0, <=5.2.45 · >=5.1.0, <=5.1.46 · >=5.0.0, <=5.0.35 · >=4.2.0, <=4.2.22 · >=4.1.0, <=4.1.31 · >=4.0.0, <=4.0.11 · >=5.6.0, <5.6.15 · >=5.5.0, <5.5.40

2018-03-30 13:26:38
Highly critical - Remote Code Execution
FriendsOfPHP

drupal/core

>=8.5, <8.5.1 · >=8.4, <8.4.6 · >=8.0, <8.3.9 · >=7.0, <7.58

2018-03-28 19:30:00
Highly critical - Remote Code Execution
FriendsOfPHP

drupal/drupal

>=8.5, <8.5.1 · >=8.4, <8.4.6 · >=8.0, <8.3.9 · >=7.0, <7.58

2018-03-28 19:30:00
Possibility of manipulated condition when unfiltered input is passed to `yii\elasticsearch\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-elasticsearch

<2.0.5

2018-03-20 14:00:00
Potential remote code execution in LUA context of the redis server via methods `yii\redis\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-redis

<2.0.8

2018-03-20 14:00:00
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-dev

>=2.0.13, <2.0.13.2 · >=2.0.14, <2.0.15 · <2.0.12.1

2018-03-20 12:28:46
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2

>=2.0.13, <2.0.13.2 · >=2.0.14, <2.0.15 · <2.0.12.1

2018-03-20 12:28:46
Incorrect header injection check
FriendsOfPHP

amphp/http

<1.0.1

2018-03-15 17:25:00
Potential SQL injection vector
FriendsOfPHP

adodb/adodb-php

<5.20.12

2018-03-06 15:40:00
Incorrect signature validation
FriendsOfPHP

simplesamlphp/saml2

>=3.0, <3.1.4 · >=2.0, <2.3.8 · <1.10.6

2018-03-02 14:46:00
Incorrect signature validation
FriendsOfPHP

simplesamlphp/saml2

>=3.0, <3.1.3 · >=2.0, <2.3.7 · <1.10.5

2018-02-26 15:22:00
EZSA-2018-001 Several vulnerabilities in Forgot password, Information collector, XML text, and Matrix field type features
FriendsOfPHP

ezsystems/ezpublish-legacy

>=2011.0.0, <2017.12.2.1 · >=5.4.0, <5.4.11.3 · >=5.3.0, <5.3.12.3

2018-02-26 14:30:00
Comment reply form allows access to restricted content.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
JavaScript cross-site scripting prevention is incomplete.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
Private file access bypass.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
jQuery vulnerability with untrusted domains.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
Language fallback can be incorrect on multilingual sites with node access restrictions.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
Settings Tray access bypass.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
External link injection on 404 pages when linking to the current page.
FriendsOfPHP

drupal/core

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
Comment reply form allows access to restricted content.
FriendsOfPHP

drupal/drupal

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
JavaScript cross-site scripting prevention is incomplete.
FriendsOfPHP

drupal/drupal

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
Private file access bypass.
FriendsOfPHP

drupal/drupal

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
jQuery vulnerability with untrusted domains.
FriendsOfPHP

drupal/drupal

>=8.4.0, <8.4.5 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2018-02-20 21:35:13
« Previous Next »

Showing 5051 to 5100 of 5593 results

1 2 ... 99 100 101 102 103 104 105 ... 111 112