Advisories

Listing reported advisories sorted by their report date.

Twig may load a template outside a configured directory when using the filesystem loader
GitHub

twig/twig

>= 2.0.0, < 2.15.3 · >= 1.0.0, < 1.44.7 · >= 3.0.0, < 3.4.3

2022-09-30 05:29:37
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
GitHub

dompdf/dompdf

< 2.0.1

2022-09-30 04:31:02
Awesome Support vulnerable to persistent cross-site scripting
GitHub

awesome-support/awesome-support

<= 6.0.7

2022-09-29 19:06:20
Possibility to load a template outside a configured directory when using the filesystem loader
FriendsOfPHP

twig/twig

>=2.0.0, <2.15.3 · >=1.0.0, <1.44.7 · >=3.0.0, <3.4.3

2022-09-28 10:36:08
Craft CMS Cross-site Scripting vulnerability
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.2.1 · >= 3.7.39, < 3.7.51

2022-09-23 20:50:54
ICEcoder vulnerable to Path Traversal
GitHub

icecoder/icecoder

<= 8.1

2022-09-23 20:39:51
Pimcore vulnerable to cross site scripting
GitHub

pimcore/pimcore

<= 10.5.6

2022-09-23 13:56:46
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.2.1

2022-09-23 13:53:36
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type
GitHub

pagekit/pagekit

<= 1.0.18

2022-09-22 22:45:46
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
GitHub

craftcms/cms

>= 3.7.0-beta.1, < 3.7.55.2 · >= 4.0.0-RC1, < 4.2.1

2022-09-22 15:09:09
Remote file inclusion
FriendsOfPHP

dompdf/dompdf

<2.0.1

2022-09-22 13:54:00
Microweber Cross-site Scripting can result in redirection to a malicious site
GitHub

microweber/microweber

<= 1.3.1

2022-09-21 21:36:29
YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module
GitHub

yetiforce/yetiforce-crm

<= 6.4.0

2022-09-21 21:32:00
YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module
GitHub

yetiforce/yetiforce-crm

<= 6.4.0

2022-09-21 21:26:10
YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module
GitHub

yetiforce/yetiforce-crm

<= 6.4.0

2022-09-21 21:22:01
Microweber vulnerable to HTML Injection in create tag functionality
GitHub

microweber/microweber

<= 1.3.1

2022-09-21 21:14:01
Moodle Cross-site Scripting vulnerability
GitHub

moodle/moodle

>= 3.11.0, < 3.11.10 · >= 3.10.0, <= 3.10.4 · <= 3.9.7

2022-09-21 21:01:15
Craft CMS Cross site Scripting vulnerability
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.2.1

2022-09-21 19:18:46
Craft CMS Stored Cross-site Scripting in User Addresses Title
GitHub

craftcms/cms

>= 4.0.0-RC1, < 4.2.1

2022-09-21 19:16:58
LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter
GitHub

librenms/librenms

<= 22.8.0

2022-09-20 18:50:12
Snipe-IT vulnerable to Improper Authentication
GitHub

snipe/snipe-it

< 6.0.10

2022-09-20 18:19:22
Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto
GitHub

smarty/smarty

>= 4.0.0, < 4.2.1 · < 3.1.47

2022-09-16 21:59:39
ThinkPHP deserialization vulnerability
GitHub

topthink/framework

<= 6.0.13

2022-09-16 21:28:30
Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users
GitHub

pimcore/pimcore

< 10.5.6

2022-09-16 21:15:33
Kirby CMS 2.5.12 Cross-site Request Forgery
GitHub

getkirby/cms

<= 2.5.12

2022-09-16 21:07:13
exceedone/exment and exceedone/laravel-admin Cross-site Scripting vulnerability
GitHub

exceedone/exment

>= 5.0.0, < 5.0.3 · = 3.0.0 · < 4.4.3 · < 2.2.3

2022-09-16 21:06:17
Shopware contains sensitive data in backend customer module
GitHub

shopware/shopware

<= 5.7.14

2022-09-16 21:02:56
Kirby CMS 2.5.12 Cross-site Scripting
GitHub

getkirby/cms

<= 2.5.12

2022-09-16 21:01:56
Shopware access control list bypassed via crafted specific URLs
GitHub

shopware/shopware

<= 5.7.14

2022-09-16 21:01:30
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
GitHub

typo3/html-sanitizer

>= 11.0.0, < 11.5.16 · >= 10.0.0, < 10.4.32 · >= 2.0.0, < 2.0.16 · >= 1.0.0, < 1.0.7

2022-09-16 18:50:13
snipe-it vulnerable to cross-site scripting (XSS)
GitHub

snipe/snipe-it

< 6.0.11

2022-09-16 18:49:17
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent
GitHub

react/http

>= 0.7.0, < 1.7.0

2022-09-16 18:48:56
exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability
GitHub

exceedone/exment

>= 5.0.0, < 5.0.3 · = 3.0.0 · < 4.4.3 · < 2.2.3

2022-09-16 18:48:43
Froxlor vulnerable to Cross-Site Request Forgery (CSRF)
GitHub

froxlor/froxlor

< 0.10.38

2022-09-16 18:42:36
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel
GitHub

intelliants/subrion

<= 4.2.1

2022-09-16 18:42:15
francoisjacquet/rosariosis vulnerable to Cross-Site Scripting (XSS)
GitHub

francoisjacquet/rosariosis

< 8.9.3

2022-09-16 18:41:44
Pagekit CMS cross-site scripting in Markdown text box where articles are edited
GitHub

pagekit/pagekit

<= 1.0.18

2022-09-16 18:33:34
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
GitHub

typo3/cms-core

>= 11.4.0, < 11.5.16

2022-09-16 17:16:47
TYPO3 CMS vulnerable to User Enumeration via Response Timing
GitHub

typo3/cms-core

>= 11.0.0, < 11.5.16 · >= 10.0.0, < 10.4.32 · >= 9.0.0, < 9.5.37 · >= 8.0.0, < 8.7.48 · >= 7.0.0, < 7.6.58

2022-09-16 17:16:29
TYPO3 CMS missing check for expiration time of password reset token for backend users
GitHub

typo3/cms-core

>= 11.0.0, < 11.5.16 · >= 10.4.0, < 10.4.32

2022-09-16 17:16:16
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController
GitHub

typo3/cms-core

>= 11.0.0, < 11.5.16 · >= 10.0.0, < 10.4.32 · >= 9.0.0, < 9.5.37 · >= 8.0.0, < 8.7.48 · >= 7.0.0, < 7.6.58

2022-09-16 17:15:57
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper
GitHub

typo3/cms-core

>= 11.0.0, < 11.5.16 · >= 10.3.0, < 10.4.32

2022-09-16 17:14:28
Feehi CMS host header injection vulnerability
GitHub

feehi/cms

<= 2.1.1

2022-09-16 17:07:45
Rank Math SEO plugin vulnerable to Server-Side Request Forgery
GitHub

rankmath/seo-by-rank-math

<= 1.0.95

2022-09-16 13:42:42
FeehiCMS has an arbitrary file upload vulnerability
GitHub

feehi/cms

< 2.0.8.1

2022-09-15 19:35:39
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
GitHub

typo3/cms-core

>= 11.0.0, <= 11.5.15 · >= 10.0.0, <= 10.4.31 · >= 9.0.0, <= 9.5.36 · >= 8.0.0, <= 8.7.47 · >= 7.0.0, <= 7.6.57

2022-09-15 03:26:53
RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency
GitHub

francoisjacquet/rosariosis

< 10.1

2022-09-15 03:20:16
smarty_function_mailto - JavaScript injection in eval function
FriendsOfPHP

smarty/smarty

>=4.0.0, <4.2.1 · <3.1.47

2022-09-14 11:32:59
TYPO3-CORE-SA-2022-011: By-passing Cross-Site Scripting Protection in HTML Sanitizer
FriendsOfPHP

typo3/cms-core

>=11.0.0, <11.5.16 · >=10.0.0, <10.4.32

2022-09-13 08:07:54
TYPO3-CORE-SA-2022-011: By-passing Cross-Site Scripting Protection in HTML Sanitizer
FriendsOfPHP

typo3/cms

>=11.0.0, <11.5.16 · >=10.0.0, <10.4.32

2022-09-13 08:07:54
« Previous Next »

Showing 3801 to 3850 of 5933 results

1 2 ... 74 75 76 77 78 79 80 ... 118 119