Advisory Catalog

Moodle Logout CSRF in admin/tool/mfa/auth.php

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Moodle CSRF risk in admin preset tool management of presets

Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

javascript-deobfuscator crafted payload can lead to code execution

TYPO3 frontend login vulnerable to Session Fixation

TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts

TYPO3 possible cache poisoning on the homepage when anchors are used

TYPO3 Arbitrary Shell Execution in Swiftmailer library

TYPO3 Possible Insecure Deserialization in Extbase Request Handling

TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API

TYPO3 Security Misconfiguration in Frontend Session Handling

TYPO3 Arbitrary Code Execution via File List Module

TYPO3 Security Misconfiguration for Backend User Accounts

TYPO3 Denial of Service in Frontend Record Registration

TYPO3 Security Misconfiguration in Install Tool Cookie

TYPO3 CMS Insecure Deserialization

TYPO3 CMS Privilege Escalation and SQL Injection

TYPO3 CMS Authentication Bypass vulnerability

Thelia authentication bypass vulnerability

symfony/validator XML Entity Expansion vulnerability

symfony/translation XML Entity Expansion vulnerability

Symfony Cross-Site Request Forgery vulnerability in the Web Profiler

Symfony XML Entity Expansion security vulnerability

Symfony XXE security vulnerability

Symfony allows direct access of ESI URLs behind a trusted proxy

Symfony vulnerable to denial of service via a malicious HTTP Host header

Code injection in the way Symfony implements translation caching in FrameworkBundle

Symfony XML Entity Expansion security vulnerability

The Migrate queue importer module enables you to create cron migrations(configuration entities) with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an att

This module enables you to create responsive image styles that depend on the parent element's width. The module doesn't sufficiently check access to rendered images, resulting in access bypass vulnerabilities in specific scenarios.

mysql2 vulnerable to Prototype Pollution

Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag

ansibleguy-webui Cross-site Scripting vulnerability

Check Point Quantum Security Gateways Information Disclosure Vulnerability

silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)

silverstripe/taxonomy SQL Injection vulnerability

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

silverstripe/graphql Cross-Site Request Forgery vulnerability

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

silverstripe/framework has possible denial of service attack vector when flushing

silverstripe/framework allows upload of dangerous file types

silverstripe/framework code execution vulnerability

silverstripe/framework BackURL validation bypass with malformed URLs

silverstripe/framework SQL injection in full text search

silverstripe/framework CSV Excel Macro Injection

silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms

silverstripe/framework's User-Agent header not correctly invalidating user session

ip SSRF improper categorization in isPublic