Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

SS-2025-001 - User enumeration via timing attack
FriendsOfPHP

silverstripe/framework

<5.3.23

2025-04-10 02:37:11
CVE-2025-30148 - XSS vulnerability in HTML editor
FriendsOfPHP

silverstripe/framework

<5.3.23

2025-04-10 02:37:11
CVE-2025-25197 - XSS attack in elemental "Content blocks in use" report
FriendsOfPHP

dnadesign/silverstripe-elemental

<5.3.12

2025-04-10 02:37:11
TYPO3-EXT-SA-2025-002: Cross-Site Scripting in extension “Additional TCA” (additional_tca)
FriendsOfPHP

codingms/additional-tca

>=1.7.0, <1.15.17 · >=1.16.0, <1.16.9

2025-03-18 09:38:00
TYPO3-EXT-SA-2025-003: Multiple vulnerabilities in extension “[clickstorm] SEO” (cs_seo)
FriendsOfPHP

clickstorm/cs-seo

>=9.0.0, <9.2.0 · >=8.0.0, <8.3.0 · >=7.0.0, <7.4.0 · >=6.0.0, <6.7.0

2025-03-18 09:04:00
Missing output escaping for the null coalesce operator
FriendsOfPHP

twig/twig

>=3.16.0, <3.19.0

2025-01-29 06:52:00
TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)
FriendsOfPHP

causal/oidc

<4.0.0

2025-01-27 18:56:00
CVE-2024-53277 - XSS in form messages
FriendsOfPHP

silverstripe/framework

<5.3.8

2025-01-14 21:24:36
CVE-2024-47605 - XSS via insert media remote file oembed
FriendsOfPHP

silverstripe/framework

<5.3.8

2025-01-14 21:24:19
SS-2024-002 - Reflected Cross Site Scripting (XSS) in error message
FriendsOfPHP

silverstripe/framework

<5.3.8

2025-01-14 21:23:51
Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
FriendsOfPHP

laravel/framework

>=11.9.0, <11.36.0

2024-12-13 15:51:00
Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
FriendsOfPHP

laravel/framework

>=11.9.0, <11.36.0

2024-12-13 15:51:00
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/security-http

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
Laravel environment manipulation via query string
FriendsOfPHP

laravel/framework

>=10.0.0, <10.48.23 · >=11.0.0, <11.31.0 · >=9.0.0, <9.52.17 · >=8.0.0, <8.83.28 · >=7.0.0, <7.30.7 · <6.20.45

2024-11-12 22:19:00
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Unguarded calls to __toString() when nesting an object into an array
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/runtime

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/process

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/http-foundation

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
TYPO3-EXT-SA-2024-007: Insecure Direct Object Reference in extension "powermail" (powermail)
FriendsOfPHP

in2code/powermail

>=12.0.0, <12.4.1 · >=9.0.0, <10.9.1 · >=8.0.0, <8.5.1 · <7.5.1

2024-09-17 08:51:00
Possible sandbox bypass
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.0 · >=3.0.0, <3.11.0 · >=2.0.0, <2.16.0 · >=1.0.0, <1.44.7

2024-09-09 08:51:06
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/validator

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
TYPO3-EXT-SA-2024-006: Multiple vulnerabilities in "powermail" (powermail)
FriendsOfPHP

in2code/powermail

>=12.0.0, <12.4.0 · >=9.0.0, <10.9.0 · >=8.0.0, <8.5.0 · <7.5.0

2024-08-27 06:59:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/symfony

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/security-bundle

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
CVE-2024-29885 - Reports are still accessible even when canView is set to false
FriendsOfPHP

silverstripe/reports

<5.2.3

2024-07-17 00:24:42
SS-2024-001 - TinyMCE allows svg files linked in object tags
FriendsOfPHP

silverstripe/framework

<5.2.16

2024-07-17 00:24:42
CVE-2024-32981 - XSS Vulnerability with text/html base64-encoded payload
FriendsOfPHP

silverstripe/framework

<5.2.16

2024-07-17 00:24:42
Arbitrary Code Execution through Improper Restriction of XML External Entity Reference (XXE) vulnerability
FriendsOfPHP

magento/product-community-edition

>=2.4.7, <2.4.7-p1 · >=2.4.6, <2.4.6-p6 · >=2.4.5, <2.4.5-p8 · >=2.4.4, <2.4.4-p9 · <2.4.4

2024-06-11 14:05:00
TYPO3-EXT-SA-2024-003: Multiple vulnerabilities in "Events 2" (events2)
FriendsOfPHP

jweiland/events2

>=9.0.0, <9.0.6 · <8.3.7

2024-06-08 09:30:00
TYPO3-EXT-SA-2024-004: Broken Access Control in "Integration of Friendly Captcha" (friendlycaptcha_official)
FriendsOfPHP

studiomitte/friendlycaptcha

>=0.0.1, <0.1.4

2024-06-08 09:03:00
Insecure HTTPS Connections due to Missing Default Certificate Validation
FriendsOfPHP

nategood/httpful

>=0.3.0, <1.0.0 · >=0.2.0, <0.3.0 · <0.2.0

2024-05-01 11:33:16
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
FriendsOfPHP

paragonie/ecc

>=2, <2.0.1

2024-04-24 12:02:00
mdanter/ecc affected by timing vulnerability in cryptographic side-channels
FriendsOfPHP

mdanter/ecc

>=1, <2.0.0 · >=0, <1

2024-04-24 12:02:00
Cryptographic side-channels in PHPECC
FriendsOfPHP

mdanter/ecc

>=1, <2.0.0 · >=0, <1

2024-04-24 00:00:00
TYPO3-EXT-SA-2024-002: Authentication Bypass in "OpenID Connect Authentication" (oidc)
FriendsOfPHP

causal/oidc

<2.1.0

2024-04-02 08:03:00
phpseclib does not properly limit the ASN1 OID length
FriendsOfPHP

phpseclib/phpseclib

>=3.0.0, <3.0.36 · >=2.0.0, <2.0.47 · >=1.0.0, <1.0.23

2024-03-02 00:31:33
phpseclib a large prime can cause a denial of service
FriendsOfPHP

phpseclib/phpseclib

>=3.0.0, <3.0.36 · >=2.0.0, <2.0.47 · >=1.0.0, <1.0.23

2024-03-02 00:31:33
CVE-2023-49783 No permission checks for editing or deleting records with CSV import form
FriendsOfPHP

silverstripe/admin

>=1.0.0, <1.13.19 · >=2.0.0, <2.1.8

2024-01-23 03:15:49
CVE-2023-44401 View permissions are bypassed for paginated lists of ORM data in GraphQL queries
FriendsOfPHP

silverstripe/graphql

>=5.0.0, <5.1.3 · >=4.0.0, <4.3.7

2024-01-22 23:26:08
CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter
FriendsOfPHP

silverstripe/framework

>=4.0.0, <4.13.39 · >=5.0.0, <5.1.11 · >=3.0.0, <4.0.0

2024-01-22 22:58:52
TYPO3-EXT-SA-2023-010: Broken Access Control in extension "femanager" (femanager)
FriendsOfPHP

in2code/femanager

>=7.0.0, <7.2.3

2023-12-13 11:55:00
TYPO3-EXT-SA-2023-011: Configuration Injection in extension "Direct Mail" (direct_mail)
FriendsOfPHP

directmailteam/direct-mail

>=8.0.0, <9.5.2 · >=7.0.0, <7.0.3 · <6.0.3

2023-12-12 20:59:00
« Previous Next »

Showing 1 to 50 of 1353 results

1 2 3 4 5 6 7 8 9 10 ... 27 28