Advisories

Listing reported advisories sorted by their report date.

CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/security-http

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
Laravel environment manipulation via query string
FriendsOfPHP

laravel/framework

>=10.0.0, <10.48.23 · >=11.0.0, <11.31.0 · >=9.0.0, <9.52.17 · >=8.0.0, <8.83.28 · >=7.0.0, <7.30.7 · <6.20.45

2024-11-12 22:19:00
Laravel environment manipulation via query string
GitHub

laravel/framework

>= 10.0.0, < 10.48.23 · >= 11.0.0, < 11.31.0 · >= 9.0.0, < 9.52.17 · >= 8.0.0, < 8.83.28 · >= 7.0.0, < 7.30.7 · < 6.20.45

2024-11-12 22:08:44
Moodle Cross-site Scripting vulnerability
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:27:52
Moodle has insufficient capability checks
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:27:17
Moodle's user/power level management inconsistent with suspended users
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6

2024-11-12 21:26:48
Moodle authorization headers preserved between "emulated redirects"
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:25:48
Moodle has insufficient access control
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2

2024-11-12 21:25:11
Moodle has user information visibility control issues in gradebook reports
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:23:41
Moodle admin presets export tool includes some secrets that should not be exported
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:22:52
Orchid Platform has Method Exposure Vulnerability in Modals
GitHub

orchid/platform

>= 8.0, < 14.43.0

2024-11-12 19:56:55
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:43:03
Twig has unguarded calls to `__toString()` when nesting an object into an array
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:42:26
Moodle LFI vulnerability when restoring malformed block backups
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:30:38
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:28:38
Moodle vulnerable to site administration SQL injection via XMLDB editor
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:28:03
Moodle has CSRF risk in Feedback non-respondents report
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:27:28
Moodle's IDOR in badges allows deletion of arbitrary badges
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:26:58
Moodle vulnerable to cache poisoning via injection into storage
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:21:18
Moodle has arbitrary file read risk through pdfTeX
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:19:25
Moodle Remote Code Execution vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:15:26
PHPExcel XXE Vulnerability
GitHub

phpoffice/phpexcel

< 1.8.1

2024-11-07 17:29:00
Filament has exported files stored in default (`public`) filesystem if not reconfigured
GitHub

filament/actions

>= 3.2.0, < 3.2.123

2024-11-07 16:14:16
UnoPim Cross-site Scripting vulnerability
GitHub

unopim/unopim

< 0.1.4

2024-11-06 20:21:57
Symfony vulnerable to command execution hijack on Windows with Process class
GitHub

symfony/process

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:57
Symfony vulnerable to open redirect via browser-sanitized URLs
GitHub

symfony/http-foundation

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:12
Symfony has an incorrect response from Validator when input ends with `\n`
GitHub

symfony/symfony

>= 6.0.0, < 6.4.11 · >= 7.0.0, < 7.1.4 · < 5.4.43

2024-11-06 15:21:09
Symfony's `Security::login` does not take into account custom `user_checker`
GitHub

symfony/security-bundle

>= 7.0.0, < 7.0.10 · >= 6.2.0, < 6.4.10 · >= 7.1.0, < 7.1.3

2024-11-06 15:13:43
Symfony allows changing the environment through a query
GitHub

symfony/runtime

>= 6.0.0, < 6.4.14 · >= 5.3.0, < 5.4.46 · >= 7.0.0, < 7.1.7

2024-11-06 15:11:11
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Unguarded calls to __toString() when nesting an object into an array
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Potential XSS vulnerability in jQuery
GitHub

maximebf/debugbar

< 1.19.0

2024-11-05 20:19:48
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
GitHub

maximebf/debugbar

< 1.19.0

2024-11-05 20:16:56
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/runtime

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/process

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/http-foundation

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
Cross-site scripting vulnerability in includes/actions/InfoAction.php
GitHub

mediawiki/core

>= 1.22.0, < 1.22.6 · < 1.21.9

2024-11-01 23:10:24
img_auth.php may leak private extension images into the public cache
GitHub

mediawiki/core

>= 1.34.0, < 1.34.2 · >= 1.32.0, < 1.33.4 · < 1.31.8

2024-11-01 23:09:03
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
GitHub

mediawiki/core

>= 1.39.0, < 1.39.3 · >= 1.38.0, < 1.38.6 · < 1.35.10

2024-11-01 22:02:39
raspap-webgui vulnerable to denial of service
GitHub

billz/raspap-webgui

< 3.1.0

2024-11-01 21:45:51
Laravel Reverb Missing API Signature Verification
GitHub

laravel/reverb

< 1.4.0

2024-10-31 18:03:12
YesWiki Uses a Broken or Risky Cryptographic Algorithm
GitHub

yeswiki/yeswiki

<= 4.4.4

2024-10-31 17:12:38
ThinkPHP deserialization vulnerability
GitHub

topthink/thinkphp

>= 6.1.3, <= 8.0.4

2024-10-30 22:08:19
PEAR::Archive_Tar Directory Traversal vulnerability
GitHub

pear/archive_tar

>= 1.2, < 1.3.2

2024-10-30 18:09:28
MediaWiki Denial of Service vulnerability
GitHub

mediawiki/core

>= 1.36.0, < 1.39.5 · < 1.35.12 · = 1.40.0

2024-10-30 18:06:32
« Previous Next »

Showing 101 to 150 of 5593 results

1 2 3 4 5 6 7 8 9 10 ... 111 112