Advisories via GitHub

Listing reported advisories via GitHub sorted by their report date.

Mautic vulnerable to Improper Access Control in UI upgrade process
GitHub

mautic/core-lib

>= 5.0.0-alpha, < 5.1.1 · >= 1.1.3, < 4.4.13

2024-09-18 17:43:39
Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.3

2024-09-17 22:02:27
czim/file-handling vulnerable to SSRF and directory traversal
GitHub

czim/file-handling

>= 2.0.0, < 2.3.0 · < 1.5.0

2024-09-17 21:23:59
Kimai has an XXE Leading to Local File Read
GitHub

kimai/kimai

<= 2.20.1

2024-09-17 18:36:50
Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content
GitHub

wireui/wireui

>= 2.0.0, < 2.1.3 · < 1.19.3

2024-09-17 18:33:15
Contao affected by insert tag injection via canonical URL
GitHub

contao/core-bundle

>= 4.13.0, < 4.13.49 · >= 5.0.0, < 5.3.15 · >= 5.4.0, < 5.4.3

2024-09-17 14:59:03
Contao affected by directory traversal in the file selector widget
GitHub

contao/core-bundle

< 4.13.49

2024-09-17 14:58:45
Contao affected by remote command execution through file upload
GitHub

contao/core-bundle

>= 4.0.0, < 4.13.49 · >= 5.0.0, < 5.3.15 · >= 5.4.0, < 5.4.3

2024-09-17 14:58:36
Concrete CMS Stored XSS in the "Next&Previous Nav" block
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.4 · < 8.5.19

2024-09-16 21:23:25
Magento Open Source Improper Authorization vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:10:09
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:44
Magento Open Source Cross-Site Request Forgery (CSRF) vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:35
Magento Open Source Cross-Site Request Forgery vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 20:09:18
Magento Open Source Path Traversal vulnerability
GitHub

magento/community-edition

>= 2.4.7-p1, < 2.4.7-p2 · >= 2.4.6-p1, < 2.4.6-p7 · >= 2.4.5-p1, < 2.4.5-p9 · < 2.4.4-p10 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-09-16 18:26:16
Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint
GitHub

pxlrbt/filament-excel

>= 2.0.0-alpha, < 2.3.3 · < 1.1.14 · < 2.3.3

2024-09-16 14:55:11
EC-CUBE Open redirect vulnerability
GitHub

ec-cube/ec-cube

>= 3.0.0, <= 3.0.16 · >= 3.0.0, < 3.0.16

2024-09-13 19:33:38
Twig has a possible sandbox bypass
GitHub

twig/twig

>= 3.12.0, < 3.14.0 · >= 3.0.0, < 3.14.0 · >= 3.0.0, < 3.11.1 · >= 2.0.0, < 2.16.1 · >= 1.0.0, < 1.44.8

2024-09-10 17:12:23
ThinkPHP deserialization vulnerability
GitHub

topthink/framework

>= 6.1.3, <= 8.0.4

2024-09-09 22:33:12
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
GitHub

craftcms/cms

>= 5.0.0, < 5.1.2

2024-09-09 18:18:28
Httpful is Missing Certificate Validation
GitHub

nategood/httpful

< 1.0.0

2024-09-09 18:18:15
Bootstrap Cross-Site Scripting (XSS) vulnerability
GitHub

twbs/bootstrap

>= 4.0.0, <= 4.6.2

2024-09-06 19:07:45
SQL Injection vulnerability in Reportico Till
GitHub

reportico-web/reportico

<= 8.1.0

2024-09-04 20:20:21
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
GitHub

pimcore/data-importer

>= 11.1.0.0, < 11.1.6.11 · >= 10.6.9.0, < 10.6.9.12 · >= 1.9.0, < 1.9.3 · >= 1.5.0, < 1.5.4 · >= 1.4.0, < 1.4.7 · < 1.3.11 · < 1.8.9

2024-09-03 19:45:27
FeehiCMS User[avatar] unrestricted upload
GitHub

feehi/cms

<= 2.1.1

2024-08-30 19:53:35
FeehiCMS BannerForm[img] unrestricted upload
GitHub

feehi/cms

<= 2.1.1

2024-08-30 19:53:33
FeehiCMS file upload vulnerability
GitHub

feehi/cms

<= 2.1.1

2024-08-30 19:53:23
Powermail TYPO3 extension Broken Access Control in the OutputController
GitHub

in2code/powermail

>= 11.0.0, < 12.4.0 · >= 9.0.0, < 10.9.0 · >= 8.0.0, < 8.5.0 · < 7.5.0

2024-08-29 18:04:58
WWBN AVideo Remote Code Execution
GitHub

wwbn/avideo

>= 12.4, <= 14.2

2024-08-29 18:03:37
"powermail" (powermail) Insecure Direct Object Reference (IDOR)
GitHub

in2code/powermail

>= 11.0.0, < 12.4.0 · >= 9.0.0, < 10.9.0 · >= 8.0.0, < 8.5.0 · < 7.5.0

2024-08-29 17:59:04
Kirby has insufficient permission checks in the language settings
GitHub

getkirby/cms

>= 3.9.0, <= 3.9.8.1 · >= 3.8.0, <= 3.8.4.3 · >= 3.7.0, <= 3.7.5.4 · >= 3.10.0, <= 3.10.1 · >= 4.0.0, <= 4.3.0 · <= 3.6.6.5

2024-08-29 17:55:32
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains <SQL_UNPRIVILEGED_PASSWORD>
GitHub

froxlor/froxlor

<= 2.2.0-rc3

2024-08-23 18:54:33
nukeviet Deserialization of Untrusted Data vulnerability
GitHub

nukeviet/nukeviet

<= 4.5

2024-08-21 20:09:00
Concrete CMS vulnerable to Stored Cross-site Scripting
GitHub

concrete5/concrete5

>= 9.0.0RC1, < 9.3.3

2024-08-20 20:02:06
Concrete CMS Stored Cross-site Scripting vulnerability
GitHub

concrete5/concrete5

>= 9.0.0RC1, < 9.3.3 · < 8.5.18

2024-08-19 22:08:02
Bolt CMS Cross-site Scripting vulnerability
GitHub

bolt/bolt

<= 3.7.1

2024-08-19 21:49:30
Automad arbitrary file upload vulnerability
GitHub

automad/automad

<= 2.0.0-alpha.5 · < 2.0.0-alpha.5

2024-08-19 21:03:26
Cross-Site Request Forgery (CSRF) in automad/automad
GitHub

automad/automad

< 2.0.0-alpha.1 · <= 1.10.9

2024-08-19 20:52:33
Cross site scripting in automad/automad
GitHub

automad/automad

< 1.8.0

2024-08-19 20:49:57
Cross site scripting in moodle
GitHub

moodle/moodle

<= 3.10.9

2024-08-15 22:21:39
Persistent Cross-site Scripting in eZ Platform Rich Text Field Type
GitHub

ezsystems/ezplatform-richtext

>= 3.3.0, < 3.3.40

2024-08-14 18:08:23
Persistent Cross-site Scripting in Ibexa RichText Field Type
GitHub

ibexa/fieldtype-richtext

>= 4.6.0, < 4.6.10

2024-08-14 18:08:20
Concrete CMS Stored XSS in getAttributeSetName
GitHub

concrete5/concrete5

>= 9.0.0, < 9.3.3 · < 8.5.18

2024-08-08 20:40:13
Shopware vulnerable to blind SQL-injection in DAL aggregations
GitHub

shopware/core

>= 6.6.0.0, <= 6.6.5.0 · <= 6.5.8.12

2024-08-08 14:53:58
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
GitHub

shopware/core

>= 6.6.0.0, <= 6.6.5.0 · <= 6.5.8.12

2024-08-08 14:50:12
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
GitHub

shopware/core

>= 6.6.0.0, <= 6.6.5.0 · <= 6.5.8.12

2024-08-08 14:48:03
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
GitHub

shopware/core

>= 6.6.0.0, <= 6.6.5.0 · <= 6.5.8.12

2024-08-08 14:42:59
Microweber Cross Site Scripting (XSS) vulnerability
GitHub

microweber/microweber

<= 2.0.16

2024-08-08 13:26:09
Magento Open Source Incorrect Authorization vulnerability
GitHub

magento/community-edition

>= 2.4.6-p1, < 2.4.6-p6 · >= 2.4.5-p1, < 2.4.5-p8 · < 2.4.4-p9 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-08-07 17:43:56
Magento Open Source Cross-Site Scripting (XSS) vulnerability
GitHub

magento/community-edition

>= 2.4.6-p1, < 2.4.6-p6 · >= 2.4.5-p1, < 2.4.5-p8 · < 2.4.4-p9 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-08-07 17:43:49
Magento Open Source Improper Authorization vulnerability
GitHub

magento/community-edition

>= 2.4.6-p1, < 2.4.6-p6 · >= 2.4.5-p1, < 2.4.5-p8 · < 2.4.4-p9 · = 2.4.7 · = 2.4.6 · = 2.4.5 · = 2.4.4

2024-08-07 17:43:36
« Previous Next »

Showing 601 to 650 of 4580 results

1 2 ... 10 11 12 13 14 15 16 ... 91 92