Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

REST API can bypass comment approval.
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.7 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-08-16 17:10:35
Entity access bypass for entities that do not have UUIDs or have protected revisions.
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.7 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-08-16 17:10:35
Views does not properly restrict access to the Ajax endpoint.
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.7 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-08-16 17:10:35
REST API can bypass comment approval.
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.7 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-08-16 17:10:35
Entity access bypass for entities that do not have UUIDs or have protected revisions.
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.7 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-08-16 17:10:35
XSS vulnerability in code example
FriendsOfPHP

phpmailer/phpmailer

>=5.0.0, <5.2.24

2017-07-26 18:02:31
CVE-2017-11365: Empty passwords validation issue
FriendsOfPHP

symfony/security-core

>=3.2.10, <3.2.12 · >=2.8.23, <2.8.25 · >=2.7.30, <2.7.32 · >=3.3.3, <3.3.5

2017-07-17 10:54:11
CVE-2017-11365: Empty passwords validation issue
FriendsOfPHP

symfony/security

>=3.2.10, <3.2.12 · >=2.8.23, <2.8.25 · >=2.7.30, <2.7.32 · >=3.3.3, <3.3.5

2017-07-17 10:54:11
CVE-2017-11365: Empty passwords validation issue
FriendsOfPHP

symfony/symfony

>=3.2.10, <3.2.12 · >=2.8.23, <2.8.25 · >=2.7.30, <2.7.32 · >=3.3.3, <3.3.5

2017-07-17 10:54:11
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
FriendsOfPHP

contao/contao

>=4.0.0, <4.4.1

2017-07-12 09:09:38
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
FriendsOfPHP

contao/core-bundle

>=4.0.0, <4.4.1

2017-07-12 09:09:38
A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter
FriendsOfPHP

contao/core

>=3.0.0, <3.5.28

2017-07-12 07:10:24
Invalid token creation and validation
FriendsOfPHP

simplesamlphp/simplesamlphp

>=1.14.0, <1.14.15

2017-06-28 14:13:10
Remote Code Execution Vulnerability
FriendsOfPHP

shopware/shopware

>=5.2.0, <5.2.25 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.3.0, <5.0.0 · >=4.2.0, <4.3.0

2017-06-22 10:07:00
PECL YAML parser unsafe object handling
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
File REST resource does not properly validate
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
PECL YAML parser unsafe object handling
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
File REST resource does not properly validate
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.4 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-06-21 18:13:27
SS-2017-002: Member disclosure in login form
FriendsOfPHP

silverstripe/framework

>=3.5.0, <3.5.4 · >=3.4.0, <3.4.6

2017-05-30 22:03:17
SS-2017-003: XSS in RedirectorPage
FriendsOfPHP

silverstripe/framework

>=3.5.0, <3.5.4 · >=3.4.0, <3.4.6

2017-05-30 22:03:17
SS-2017-004: XSS in page history comparison
FriendsOfPHP

silverstripe/framework

>=3.5.0, <3.5.4 · >=3.4.0, <3.4.6

2017-05-30 22:03:17
Missing state parameter in OAuth requests leading to CSRF vulnerability
FriendsOfPHP

sensiolabs/connect

<4.2.3

2017-05-30 11:55:16
Arbitrary shell execution
FriendsOfPHP

squizlabs/php_codesniffer

>=3.0.0, <3.0.1

2017-05-18 04:24:49
Remote Code Execution
FriendsOfPHP

3f/pygmentize

<1.2

2017-05-15 09:09:00
Cookie leakage to wrong origins and non-restricted cookie acceptance
FriendsOfPHP

amphp/artax

>=2, <2.0.6 · <1.0.6

2017-05-09 19:42:02
Password reset phishing vulnerability
FriendsOfPHP

illuminate/auth

>=5.3.0, <=5.3.31 · >=5.4.0, <5.4.22

2017-05-07 17:49:26
Password reset phishing vulnerability
FriendsOfPHP

laravel/framework

>=5.3.0, <=5.3.31 · >=5.4.0, <5.4.22

2017-05-07 17:49:26
Authentication context bypass (multiauth module)
FriendsOfPHP

simplesamlphp/simplesamlphp

<1.14.14

2017-05-05 10:47:00
Session fixation and authentication bypass (authcrypt module)
FriendsOfPHP

simplesamlphp/simplesamlphp

>=1.14.12, <1.14.14

2017-05-05 10:46:00
Unauthenticated encryption in CBC mode
FriendsOfPHP

simplesamlphp/simplesamlphp

<1.14.13

2017-04-26 13:24:00
Access bypass
FriendsOfPHP

drupal/core

>=8.3.0, <8.3.1 · >=8.2.0, <8.2.8 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-04-19 16:07:22
Access bypass
FriendsOfPHP

drupal/drupal

>=8.3.0, <8.3.1 · >=8.2.0, <8.2.8 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-04-19 16:07:22
Flow Bugfix Releases for Entity Security
FriendsOfPHP

neos/flow

>=3.3.0, <3.3.13 · >=3.2.0, <3.2.13 · >=3.1.0, <3.1.10 · >=3.0.0, <3.0.12 · >=4.0.0, <4.0.6

2017-04-12 17:00:00
Flow Bugfix Releases for Entity Security
FriendsOfPHP

typo3/flow

>=3.3.0, <3.3.13 · >=3.2.0, <3.2.13 · >=3.1.0, <3.1.10 · >=3.0.0, <3.0.12 · >=4.0.0, <4.0.6

2017-04-12 17:00:00
Incorrect IV generation for encryption
FriendsOfPHP

simplesamlphp/simplesamlphp

>=1.14.0, <1.14.12

2017-03-30 09:51:00
Cross-site scripting (XSS) vulnerability in Paypal-Merchant-SDK-PHP
FriendsOfPHP

paypal/merchant-sdk-php

>=3.0.0, <3.12.0 · <3.0

2017-03-29 16:13:00
Multiple timing side-channel issues
FriendsOfPHP

simplesamlphp/simplesamlphp

>=1.14.0, <1.14.12 · >=1.13.0, <1.14.0 · >=1.12.0, <1.13.0

2017-03-17 09:34:24
Editor module incorrectly checks access to inline private files
FriendsOfPHP

drupal/core

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
Some admin paths were not protected with a CSRF token
FriendsOfPHP

drupal/core

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
Remote code execution
FriendsOfPHP

drupal/core

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
Editor module incorrectly checks access to inline private files
FriendsOfPHP

drupal/drupal

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
Some admin paths were not protected with a CSRF token
FriendsOfPHP

drupal/drupal

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
Remote code execution
FriendsOfPHP

drupal/drupal

>=8.2.0, <8.2.7 · >=8.1.0, <8.2.0 · >=8.0, <8.1.0

2017-03-15 20:19:51
An error during signature verification can be treated as a successful verification.
FriendsOfPHP

onelogin/php-saml

<2.10.4

2017-02-28 15:37:00
Authentication Bypass in TYPO3 Frontend
FriendsOfPHP

typo3/cms

>=8.6.0, <8.6.1 · >=8.5.0, <8.6.0 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0

2017-02-28 10:23:00
Cross-Site Scripting in TYPO3 CMS
FriendsOfPHP

typo3/cms

>=7.6.0, <7.6.16 · >=8.6.0, <8.6.1 · >=8.5.0, <8.6.0 · >=8.4.0, <8.5.0 · >=8.3.0, <8.4.0 · >=8.2.0, <8.3.0 · >=8.1.0, <8.2.0 · >=8.0.0, <8.1.0

2017-02-28 10:23:00
Arbitrary shell execution
FriendsOfPHP

squizlabs/php_codesniffer

>=2.0.0, <2.8.1 · >=1.0.0, <2.0.0

2017-02-26 22:15:53
SUPEE-9652 - Remote Code Execution using mail vulnerability
FriendsOfPHP

magento/magento1ce

>=1.5.0.1, <1.9.3.2

2017-02-07 00:00:00
« Previous Next »

Showing 901 to 950 of 1341 results

1 2 ... 16 17 18 19 20 21 22 ... 26 27