Advisories via FriendsOfPHP

Listing reported advisories via FriendsOfPHP sorted by their report date.

SS-2015-027: HtmlEditor embed url sanitisation
FriendsOfPHP

silverstripe/framework

>=3.2.0, <3.2.1 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2015-11-13 10:30:00
SS-2015-026: Form field validation message XSS vulnerability
FriendsOfPHP

silverstripe/framework

>=3.1.0, <3.1.16 · >=3.2.0, <3.2.1 · >=3.0.0, <3.1.0

2015-11-11 14:31:00
Remote File Inclusion through View template name manipulation
FriendsOfPHP

cakephp/cakephp

>=3.0.0, <3.0.15 · >=2.6.0, <2.6.12 · >=2.5.0, <2.5.99 · >=2.4.0, <2.4.99 · >=2.3.0, <2.3.99 · >=2.2.0, <2.2.99 · >=2.1.0, <2.1.99 · >=2.0.0, <2.0.99 · >=3.1.0, <3.1.4 · >=2.7.0, <2.7.6

2015-11-05 22:08:00
Multiple CRLF injection vulnerabilities
FriendsOfPHP

phpmailer/phpmailer

>=5.0.0, <5.2.14

2015-11-01 10:15:00
XSS attack vector in Security Library method xss_clean()
FriendsOfPHP

codeigniter/framework

<3.0.3

2015-10-27 12:30:18
Filesystem Permissions Issues in Multiple Components
FriendsOfPHP

zfcampus/zf-apigility-doctrine

>=1.0.0, <1.0.3

2015-09-15 18:52:15
Filesystem Permissions Issues in Multiple Components
FriendsOfPHP

zendframework/zendframework

>=2.4.0, <2.4.8

2015-09-15 17:15:06
Filesystem Permissions Issues in Multiple Components
FriendsOfPHP

zendframework/zend-cache

>=2.5.0, <2.5.3 · >=2.4.0, <2.4.8

2015-09-15 16:24:04
Filesystem Permissions Issues in Multiple Components
FriendsOfPHP

zendframework/zendframework1

>=1.12.0, <1.12.16

2015-09-15 15:50:03
Potential SQL injection vector using null byte for PDO (MsSql, SQLite)
FriendsOfPHP

zendframework/zendframework1

>=1.12.0, <1.12.16

2015-09-15 15:50:03
SS-2015-016: XSS in install.php
FriendsOfPHP

silverstripe/framework

>=3.1.0, <3.1.14

2015-09-14 10:44:00
SS-2015-017: Forum Module CSRF Vulnerability
FriendsOfPHP

silverstripe/forum

>=0.7.0, <=0.7.3 · <=0.6.1

2015-09-14 10:38:00
SS-2015-015: XSS in dev/build returnURL Parameter
FriendsOfPHP

silverstripe/framework

>=3.1.0, <3.1.14

2015-09-14 09:17:00
Backend: Non-Persistent Cross-Site Scripting
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.15 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-09-08 10:59:00
Frontend: Unauthenticated Path Disclosure
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.15 · >=7.3.0, <7.4.0 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-09-08 10:57:00
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/doctrine-bundle

<1.5.2

2015-08-31 14:47:06
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/common

>=2.5.0, <2.5.1 · >=2.0.0, <2.4.3

2015-08-31 14:42:59
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/mongodb-odm

>=1.0.0, <1.0.2

2015-08-31 14:34:50
SS-2015-018: File upload exposure on UserForms module
FriendsOfPHP

silverstripe/userforms

<3.0.0

2015-08-31 14:32:00
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/mongodb-odm-bundle

>=2.0.0, <3.0.1

2015-08-31 13:34:00
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/orm

>=2.5.0, <2.5.1 · >=2.0.0, <2.4.8

2015-08-31 13:19:01
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/cache

>=1.4.0, <1.4.2 · >=1.0.0, <1.3.2

2015-08-31 13:10:57
Security Misconfiguration Vulnerability in various Doctrine projects
FriendsOfPHP

doctrine/annotations

>=1.0.0, <1.2.7

2015-08-31 12:36:03
Remote code execution in templates
FriendsOfPHP

twig/twig

<1.20.0

2015-08-12 15:53:50
Direct access of prefixed controller actions
FriendsOfPHP

cakephp/cakephp

>=2.6.0, <2.6.11 · >=2.4.0, <2.4.99 · >=2.3.0, <2.3.99 · >=2.2.0, <2.2.99 · >=2.1.0, <2.1.99 · >=2.0.0, <2.0.99 · >=2.7.0, <2.7.2 · >=2.5.0, <2.5.9

2015-08-06 22:08:00
XXE/XEE vector when using ZendXml on multibyte payloads
FriendsOfPHP

zendframework/zendframework1

>=1.12.0, <1.12.14

2015-08-03 15:13:58
XXE/XEE vector when using ZendXml on multibyte payloads
FriendsOfPHP

zendframework/zendxml

>=1.0.0, <1.0.1

2015-08-03 15:13:58
XXE/XEE vector when using ZendXml on multibyte payloads
FriendsOfPHP

zendframework/zendframework

>=2.2.0, <2.2.99 · >=2.1.0, <2.1.99 · >=2.0.0, <2.0.99 · >=2.5.0, <2.5.1 · >=2.4.0, <2.4.6 · >=2.3.0, <2.3.8

2015-08-03 15:13:58
State guessing vulnerability
FriendsOfPHP

laravel/socialite

>=2.0.0, <2.0.10 · >=1.0.0, <1.0.99

2015-08-03 12:55:00
Critical SQL injection bug in the ODBC database driver
FriendsOfPHP

codeigniter/framework

<=3.0.6

2015-07-26 19:42:05
Security Misconfiguration Vulnerability in the AWS SDK for PHP
FriendsOfPHP

aws/aws-sdk-php

>=3.0.0, <3.2.1

2015-07-24 00:41:41
Insecure state generation
FriendsOfPHP

laravel/socialite

>=1.0.0, <1.0.99 · >=2.0.0, <2.0.9

2015-07-23 13:53:00
HTTP Proxy header vulnerability
FriendsOfPHP

guzzlehttp/guzzle

>=4.0.0-rc2, <4.2.4 · >=6, <6.2.1 · >=5, <5.3.1

2015-07-15 19:28:39
class yii\web\ViewAction allowed to include arbitrary files that end with .php
FriendsOfPHP

yiisoft/yii2-dev

<2.0.5

2015-07-10 18:12:53
class yii\web\ViewAction allowed to include arbitrary files that end with .php
FriendsOfPHP

yiisoft/yii2

<2.0.5

2015-07-10 18:12:53
Forced Redirect to External Website
FriendsOfPHP

oro/crm

>=1.7.0, <1.7.4

2015-07-08 13:51:00
Forced Redirect to External Website
FriendsOfPHP

oro/platform

>=1.7.0, <1.7.4

2015-07-08 13:47:00
Cross-Site Scripting in 3rd party library Flowplayer
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:23:00
Frontend login Session Fixation
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:20:00
Cross-Site Scripting exploitable by Editors
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:20:00
Information Disclosure possibility exploitable by Editors
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:20:00
Brute Force Protection Bypass in backend login
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:20:00
Access bypass when editing file metadata
FriendsOfPHP

typo3/cms

>=6.2.0, <6.2.14 · >=7.3.0, <7.3.1 · >=7.2.0, <7.3.0 · >=7.1.0, <7.2.0 · >=7.0.0, <7.1.0

2015-07-01 14:16:00
Potential XSS and Open Redirect vectors in zend-diactoros
FriendsOfPHP

zendframework/zend-diactoros

>=1.0.0, <1.0.4

2015-06-23 15:55:00
SS-2015-013: X-Forwarded-Host request hostname injection
FriendsOfPHP

silverstripe/framework

>=3.1.0, <3.1.13

2015-05-29 00:53:14
SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation
FriendsOfPHP

silverstripe/framework

>=3.0.0, <=3.0.13 · >=3.1.0, <3.1.13

2015-05-28 13:05:00
Denial of Service attack through XML payloads
FriendsOfPHP

cakephp/cakephp

>=2.5.0, <2.5.90 · >=2.4.0, <2.4.99 · >=2.3.0, <2.3.99 · >=2.2.0, <2.2.99 · >=2.1.0, <2.1.99 · >=2.0.0, <2.0.99 · >=3.0.0, <3.0.6 · >=2.6.0, <2.6.6

2015-05-28 11:30:00
CVE-2015-4050: ESI unauthorized access
FriendsOfPHP

symfony/http-kernel

>=2.3.19, <2.3.29 · >=2.5.4, <2.5.12 · >=2.6.0, <2.6.8 · >=2.4.9, <2.5.0

2015-05-26 23:55:51
CVE-2015-4050: ESI unauthorized access
FriendsOfPHP

symfony/symfony

>=2.3.19, <2.3.29 · >=2.5.4, <2.5.12 · >=2.6.0, <2.6.8 · >=2.4.9, <2.5.0

2015-05-26 23:55:51
SS-2015-012: External redirection risk in Security?ReturnURL
FriendsOfPHP

silverstripe/framework

>=3.1.0, <=3.1.12 · >=3.0.0, <=3.0.13

2015-05-25 14:52:00
« Previous Next »

Showing 1101 to 1150 of 1341 results

1 2 ... 18 19 20 21 22 23 24 25 26 27