Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

CVE-2018-19789: Temporary uploaded file path disclosure
FriendsOfPHP

symfony/symfony

>=2.7.38, <2.7.50 · >=4.0.0, <4.0.15 · >=3.4.0, <3.4.20 · >=2.8.0, <2.8.49 · >=4.2.0, <4.2.1 · >=4.1.0, <4.1.9 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-11-06 11:52:00
CVE-2018-19790: Open Redirect Vulnerability on login
FriendsOfPHP

symfony/symfony

>=2.7.38, <2.7.50 · >=4.0.0, <4.0.15 · >=3.4.0, <3.4.20 · >=2.8.0, <2.8.49 · >=4.2.0, <4.2.1 · >=4.1.0, <4.1.9 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-11-06 11:52:00
EZSA-2018-006 XSS vulnerability in 'disabled module' error template
FriendsOfPHP

ezsystems/ezpublish-legacy

>=2011.0.0, <2017.12.4.2 · >=2018.9.0, <2018.9.1.2 · >=2018.6.0, <2018.6.1.3 · >=5.4.0, <5.4.12.2 · >=5.3.0, <5.3.12.5

2018-11-01 09:30:00
EZSA-2018-005 Passwordless login for LDAP users
FriendsOfPHP

ezsystems/ezpublish-legacy

>=2011.0.0, <2017.12.4.1 · >=2018.9.0, <2018.9.1.1 · >=2018.6.0, <2018.6.1.2 · >=5.4.0, <5.4.12.1 · >=5.3.0, <5.3.12.4

2018-10-31 13:00:00
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
FriendsOfPHP

symfony/polyfill

>=1.0.0, <1.10.0

2018-10-31 12:19:00
Possible DOS attack with long user-submitted passwords (correct fix for CVE-2013-5958)
FriendsOfPHP

symfony/polyfill-php55

>=1.0.0, <1.10.0

2018-10-31 12:19:00
Loading JS from user space where the username is not a registered account is dangerous and should be banned
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.2 · >=1.30.0, <1.30.2 · >=1.27.0, <1.27.6

2018-10-21 19:09:31
By-passing Protection of PharStreamWrapper Interceptor
FriendsOfPHP

typo3/phar-stream-wrapper

>=3.0.0, <3.0.1 · >=2.0.0, <2.0.1 · >=1.0.0, <2.0.0

2018-10-18 13:59:00
Content moderation - Moderately critical - Access bypass
FriendsOfPHP

drupal/core

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
External URL injection through URL aliases - Moderately Critical - Open Redirect
FriendsOfPHP

drupal/core

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0 · >=7.0, <7.60

2018-10-17 22:19:00
Anonymous Open Redirect - Moderately Critical - Open Redirect
FriendsOfPHP

drupal/core

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution
FriendsOfPHP

drupal/core

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0 · >=7.0, <7.60

2018-10-17 22:19:00
Contextual Links validation - Critical - Remote Code Execution
FriendsOfPHP

drupal/core

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
Content moderation - Moderately critical - Access bypass
FriendsOfPHP

drupal/drupal

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
External URL injection through URL aliases - Moderately Critical - Open Redirect
FriendsOfPHP

drupal/drupal

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0 · >=7.0, <7.60

2018-10-17 22:19:00
Anonymous Open Redirect - Moderately Critical - Open Redirect
FriendsOfPHP

drupal/drupal

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
Injection in DefaultMailSystem::mail() - Critical - Remote Code Execution
FriendsOfPHP

drupal/drupal

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0 · >=7.0, <7.60

2018-10-17 22:19:00
Contextual Links validation - Critical - Remote Code Execution
FriendsOfPHP

drupal/drupal

>=8.6.0, <8.6.2 · >=8.5.0, <8.5.8 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2018-10-17 22:19:00
Action case insensitivity
FriendsOfPHP

alterphp/easyadmin-extension-bundle

>=1.2.0, <1.2.11 · >=1.3.0, <1.3.1

2018-10-02 00:01:00
Potential enwiki DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.2 · >=1.30.0, <1.30.2 · >=1.27.0, <1.27.6

2018-09-20 22:06:04
$wgRateLimits (rate limit / ping limiter) entry for 'user' overrides that for 'newbie'
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.1 · >=1.30.0, <1.30.1 · >=1.29.0, <1.29.3 · >=1.27.0, <1.27.5

2018-09-20 19:59:28
BotPassword can bypass CentralAuth's account lock
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.1 · >=1.30.0, <1.30.1 · >=1.29.0, <1.29.3 · >=1.27.0, <1.27.5

2018-09-20 19:59:28
1.31.0 tarball is missing .htaccess files
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.1

2018-09-20 19:59:28
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
FriendsOfPHP

fooman/tcpdf

<6.2.22

2018-09-20 05:24:43
Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
FriendsOfPHP

tecnickcom/tcpdf

<6.2.22

2018-09-14 15:26:29
Magento 2.2.6 and 2.1.15 Security update
FriendsOfPHP

magento/product-community-edition

>=2.1, <2.1.15 · >=2.2, <2.2.6

2018-09-10 00:00:00
Cookie serialization vulnerability
FriendsOfPHP

illuminate/cookie

>=5.4.0, <=5.4.36 · >=5.3.0, <=5.3.31 · >=5.2.0, <=5.2.45 · >=5.1.0, <=5.1.46 · >=5.0.0, <=5.0.35 · >=4.2.0, <=4.2.22 · >=4.1.0, <=4.1.31 · >=4.0.0, <=4.0.11 · >=5.6.0, <5.6.30 · >=5.5.0, <5.5.42

2018-08-07 18:07:12
Cookie serialization vulnerability
FriendsOfPHP

laravel/framework

>=5.4.0, <=5.4.36 · >=5.3.0, <=5.3.31 · >=5.2.0, <=5.2.45 · >=5.1.0, <=5.1.46 · >=5.0.0, <=5.0.35 · >=4.2.0, <=4.2.22 · >=4.1.0, <=4.1.31 · >=4.0.0, <=4.0.11 · >=5.6.0, <5.6.30 · >=5.5.0, <5.5.42

2018-08-07 18:07:12
CVE-2018-14773: Remove support for legacy and risky HTTP headers
FriendsOfPHP

symfony/http-foundation

>=4.0.0, <4.0.14 · >=3.4.0, <3.4.14 · >=3.3.0, <3.3.18 · >=2.8.0, <2.8.44 · >=2.7.0, <2.7.49 · >=4.1.0, <4.1.3 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-08-01 17:30:00
CVE-2018-14773: Remove support for legacy and risky HTTP headers
FriendsOfPHP

symfony/symfony

>=4.0.0, <4.0.14 · >=3.4.0, <3.4.14 · >=3.3.0, <3.3.18 · >=2.8.0, <2.8.44 · >=2.7.0, <2.7.49 · >=4.1.0, <4.1.3 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-08-01 17:30:00
SS-2018-016: Unsafe SQL Query Construction (Safe Data Source)
FriendsOfPHP

silverstripe/subsites

>=2.0.0, <2.1.1

2018-07-25 09:55:14
SS-2018-017: Possible PHP Object Injection via Multi-Value Field Extension
FriendsOfPHP

symbiote/silverstripe-multivaluefield

>=3.0.0, <3.0.99

2018-07-16 17:29:04
Authentication Bypass in TYPO3 CMS
FriendsOfPHP

typo3/cms

>=8.0.0, <8.7.17 · >=7.0.0, <7.6.30 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
FriendsOfPHP

typo3/cms

>=8.0.0, <8.7.17 · >=7.0.0, <7.6.30 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Privilege Escalation & SQL Injection in TYPO3 CMS
FriendsOfPHP

typo3/cms

>=8.5.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Insecure Deserialization in TYPO3 CMS
FriendsOfPHP

typo3/cms

>=8.5.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Authentication Bypass in TYPO3 CMS
FriendsOfPHP

typo3/cms-core

>=8.0.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
FriendsOfPHP

typo3/cms-core

>=8.0.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Privilege Escalation & SQL Injection in TYPO3 CMS
FriendsOfPHP

typo3/cms-core

>=8.5.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
Insecure Deserialization in TYPO3 CMS
FriendsOfPHP

typo3/cms-core

>=8.5.0, <8.7.17 · >=9.0.0, <9.3.2

2018-07-12 09:34:56
CSRF vulnerability in the admin panel
FriendsOfPHP

sylius/admin-bundle

>=1.0.0, <1.0.17 · >=1.2.0, <1.2.2 · >=1.1.0, <1.1.9

2018-07-09 00:26:07
CSRF vulnerability in the admin panel
FriendsOfPHP

sylius/sylius

>=1.0.0, <1.0.17 · >=1.2.0, <1.2.2 · >=1.1.0, <1.1.9

2018-07-09 00:26:07
When a log event is (partially) hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information
FriendsOfPHP

mediawiki/core

>=1.31.0, <1.31.1 · >=1.30.0, <1.30.1 · >=1.29.0, <1.29.3 · >=1.27.0, <1.27.5

2018-07-07 11:36:22
SUPEE-10752 - Multiple security enhancements vulnerabilities
FriendsOfPHP

magento/magento1ce

<1.9.3.9

2018-06-29 00:00:00
Adminer script versions up to 4.6.2 contains file disclosure vulnerability
FriendsOfPHP

vrana/adminer

<4.6.3

2018-06-28 00:00:00
Unauthenticated crypto and weak IV in Magento\Framework\Encryption
FriendsOfPHP

magento/product-community-edition

>=2.2, <2.2.6 · >=2.1, <2.2 · >=2.0, <2.1

2018-06-27 14:12:00
Magento 2.2.5 and 2.1.14 Security update
FriendsOfPHP

magento/product-community-edition

>=2.1, <2.1.14 · >=2.2, <2.2.5

2018-06-27 00:00:00
URL Rewrite vulnerability
FriendsOfPHP

zendframework/zend-diactoros

>=1.0.0, <1.8.4

2018-06-11 15:28:00
URL Rewrite vulnerability
FriendsOfPHP

zendframework/zend-feed

>=1.0.0, <2.10.3

2018-06-11 15:28:00
URL Rewrite vulnerability
FriendsOfPHP

zendframework/zend-http

>=1.0.0, <2.8.1

2018-06-11 15:28:00
« Previous Next »

Showing 751 to 800 of 1358 results

1 2 ... 13 14 15 16 17 18 19 ... 27 28