Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/security-http

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
Laravel environment manipulation via query string
FriendsOfPHP

laravel/framework

>=10.0.0, <10.48.23 · >=11.0.0, <11.31.0 · >=9.0.0, <9.52.17 · >=8.0.0, <8.83.28 · >=7.0.0, <7.30.7 · <6.20.45

2024-11-12 22:19:00
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Unguarded calls to __toString() when nesting an object into an array
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/runtime

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/process

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/http-foundation

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
TYPO3-EXT-SA-2024-007: Insecure Direct Object Reference in extension "powermail" (powermail)
FriendsOfPHP

in2code/powermail

>=12.0.0, <12.4.1 · >=9.0.0, <10.9.1 · >=8.0.0, <8.5.1 · <7.5.1

2024-09-17 08:51:00
Possible sandbox bypass
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.0 · >=3.0.0, <3.11.0 · >=2.0.0, <2.16.0 · >=1.0.0, <1.44.7

2024-09-09 08:51:06
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/validator

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
TYPO3-EXT-SA-2024-006: Multiple vulnerabilities in "powermail" (powermail)
FriendsOfPHP

in2code/powermail

>=12.0.0, <12.4.0 · >=9.0.0, <10.9.0 · >=8.0.0, <8.5.0 · <7.5.0

2024-08-27 06:59:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/symfony

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/security-bundle

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
CVE-2024-29885 - Reports are still accessible even when canView is set to false
FriendsOfPHP

silverstripe/reports

<5.2.3

2024-07-17 00:24:42
SS-2024-001 - TinyMCE allows svg files linked in object tags
FriendsOfPHP

silverstripe/framework

<5.2.16

2024-07-17 00:24:42
CVE-2024-32981 - XSS Vulnerability with text/html base64-encoded payload
FriendsOfPHP

silverstripe/framework

<5.2.16

2024-07-17 00:24:42
Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnerability
FriendsOfPHP

magento/product-community-edition

>=2.4.7, <2.4.7-p1 · >=2.4.6, <2.4.6-p6 · >=2.4.5, <2.4.5-p8 · >=2.4.4, <2.4.4-p9 · <2.4.4

2024-06-11 14:05:00
TYPO3-EXT-SA-2024-003: Multiple vulnerabilities in "Events 2" (events2)
FriendsOfPHP

jweiland/events2

>=9.0.0, <9.0.6 · <8.3.7

2024-06-08 09:30:00
TYPO3-EXT-SA-2024-004: Broken Access Control in "Integration of Friendly Captcha" (friendlycaptcha_official)
FriendsOfPHP

studiomitte/friendlycaptcha

>=0.0.1, <0.1.4

2024-06-08 09:03:00
Insecure HTTPS Connections due to Missing Default Certificate Validation
FriendsOfPHP

nategood/httpful

>=0.3.0, <1.0.0 · >=0.2.0, <0.3.0 · <0.2.0

2024-05-01 11:33:16
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
FriendsOfPHP

paragonie/ecc

>=2, <2.0.1

2024-04-24 12:02:00
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
FriendsOfPHP

mdanter/ecc

>=1, <2.0.0 · >=0, <1

2024-04-24 12:02:00
Cryptographic side-channels in PHPECC
FriendsOfPHP

mdanter/ecc

>=1, <2.0.0 · >=0, <1

2024-04-24 00:00:00
TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)
FriendsOfPHP

causal/oidc

<2.1.0

2024-04-02 08:03:00
phpseclib does not properly limit the ASN1 OID length
FriendsOfPHP

phpseclib/phpseclib

>=3.0.0, <3.0.36 · >=2.0.0, <2.0.47 · >=1.0.0, <1.0.23

2024-03-02 00:31:33
phpseclib a large prime can cause a denial of service
FriendsOfPHP

phpseclib/phpseclib

>=3.0.0, <3.0.36 · >=2.0.0, <2.0.47 · >=1.0.0, <1.0.23

2024-03-02 00:31:33
CVE-2023-49783 No permission checks for editing or deleting records with CSV import form
FriendsOfPHP

silverstripe/admin

>=1.0.0, <1.13.19 · >=2.0.0, <2.1.8

2024-01-23 03:15:49
CVE-2023-44401 View permissions are bypassed for paginated lists of ORM data in GraphQL queries
FriendsOfPHP

silverstripe/graphql

>=5.0.0, <5.1.3 · >=4.0.0, <4.3.7

2024-01-22 23:26:08
CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
FriendsOfPHP

silverstripe/framework

>=4.0.0, <4.13.39 · >=5.0.0, <5.1.11 · >=3.0.0, <4.0.0

2024-01-22 22:58:52
TYPO3-EXT-SA-2023-010: Broken Access Control in extension "femanager" (femanager)
FriendsOfPHP

in2code/femanager

>=7.0.0, <7.2.3

2023-12-13 11:55:00
TYPO3-EXT-SA-2023-011: Configuration Injection in extension "Direct Mail" (direct_mail)
FriendsOfPHP

directmailteam/direct-mail

>=8.0.0, <9.5.2 · >=7.0.0, <7.0.3 · <6.0.3

2023-12-12 20:59:00
Denial of service caused by infinite recursion when parsing SVG images
FriendsOfPHP

dompdf/dompdf

<2.0.4

2023-12-12 09:17:00
Test code in published microsoft-graph package exposes phpinfo()
FriendsOfPHP

microsoft/microsoft-graph

>=1.16.0, <1.109.1 · >=2.0.0, <2.0.1

2023-11-30 12:40:00
Test code in published microsoft-graph-core package exposes phpinfo()
FriendsOfPHP

microsoft/microsoft-graph-core

<2.0.2

2023-11-30 12:40:00
phpseclib vulnerable to denial of service
FriendsOfPHP

phpseclib/phpseclib

>=3.0.0, <3.0.34

2023-11-27 18:31:14
TYPO3-EXT-SA-2023-009: Insecure Direct Object Reference in extension "Content Consent" (content_consent)
FriendsOfPHP

t3s/content-consent

>=2.0.0, <2.0.2 · <1.0.3

2023-11-26 07:03:00
Potential URI resolution path traversal in the AWS SDK for PHP
FriendsOfPHP

aws/aws-sdk-php

>=3.0.0, <3.288.1

2023-11-22 00:00:00
TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling
FriendsOfPHP

typo3/cms-core

>=11.0.0, <11.5.33 · >=10.0.0, <10.4.41 · >=12.0.0, <12.4.8 · >=9.0.0, <9.5.44 · >=8.0.0, <8.7.55

2023-11-14 09:58:00
CVE-2023-46735: Potential XSS in WebhookController
FriendsOfPHP

symfony/webhook

>=6.3.0, <6.3.8

2023-11-10 08:00:00
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
FriendsOfPHP

symfony/twig-bridge

>=5.4.0, <5.4.31 · >=4.4.0, <4.4.51 · >=6.3.0, <6.3.8 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.3.0, <4.4.0 · >=4.2.0, <4.3.0 · >=4.1.0, <4.2.0 · >=4.0.0, <4.1.0 · >=3.4.0, <4.0.0 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.8.0, <3.0.0 · >=2.7.0, <2.8.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2023-11-10 08:00:00
CVE-2023-46735: Potential XSS in WebhookController
FriendsOfPHP

symfony/symfony

>=6.3.0, <6.3.8

2023-11-10 08:00:00
CVE-2023-46734: Potential XSS vulnerabilities in CodeExtension filters
FriendsOfPHP

symfony/symfony

>=5.4.0, <5.4.31 · >=4.4.0, <4.4.51 · >=6.3.0, <6.3.8 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.3.0, <4.4.0 · >=4.2.0, <4.3.0 · >=4.1.0, <4.2.0 · >=4.0.0, <4.1.0 · >=3.4.0, <4.0.0 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.8.0, <3.0.0 · >=2.7.0, <2.8.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2023-11-10 08:00:00
CVE-2023-46733: Potential XSS in WebhookController
FriendsOfPHP

symfony/symfony

>=5.4.0, <5.4.31 · >=6.3.0, <6.3.8 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0

2023-11-10 08:00:00
« Previous Next »

Showing 1 to 50 of 1341 results

1 2 3 4 5 6 7 8 9 10 ... 26 27