PHP: уязвимости стека · Страница 200

contao/core-bundle has path traversal vulnerability in the file manager

Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.

• Обновитесь до 4.13.21
• Обновитесь до 4.9.40
• Обновитесь до 5.1.4

CVE-2023-30177

CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

• Обновитесь до 3.7.68

CVE-2023-25313

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

• Обновитесь до 12.4

Laminas Diactoros vulnerable to HTTP Multiline Header Termination

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailin

• Обновитесь до 2.18.1
• Обновитесь до 2.19.1
• Обновитесь до 2.20.1
• Обновитесь до 2.21.1
• Обновитесь до 2.22.1
• Обновитесь до 2.23.1
• Обновитесь до 2.24.2
• Обновитесь до 2.25.2

CVE-2023-31045

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."

• Обновитесь до 1.24.2

Improper Privilege Management in microweber/microweber

Improper Privilege Management in GitHub repository microweber/microweber prior to 1.3.4.

• Обновитесь до 1.3.4

Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.

• Обновитесь до 1.3.4

Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

• Обновитесь до 3.1.12

Improper Input Validation in nyholm/psr7

### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### Patches The issue is patched in 1.6.1. ### Workarounds There are no known workarounds. ### References * https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

• Обновитесь до 1.6.1

Improper header validation in httpsoft/http-message

### Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. ### Patches The issue is patched in 1.0.12. ### Workarounds There are no known workarounds. ### References * https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

• Обновитесь до 1.0.12

Improper Access Control in francoisjacquet/rosariosis

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.

• Обновитесь до 10.9.3

CVE-2022-48150

Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.

Cross-site Scripting (XSS) - Stored in azuracast/azuracast

Cross-site Scripting (XSS) - Stored in GitHub repository azuracast/azuracast prior to 0.18.

• Обновитесь до 0.18
• Обновитесь до 0.18.0

Insecure header validation in slim/psr7

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the appl

• Обновитесь до 1.4.1
• Обновитесь до 1.5.1
• Обновитесь до 1.6.1
• Обновитесь до 1.6.1-1

Improper header name validation in guzzlehttp/psr7

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

• Обновитесь до 1.4.2-0.1+deb10u2build0.20.04.1
• Обновитесь до 1.5.0-1ubuntu0.1~esm1
• Обновитесь до 1.5.1-2
• Обновитесь до 1.8.3-1ubuntu0.1~esm1
• Обновитесь до 1.9.1
• Обновитесь до 2.4.5
• Обновитесь до 2.4.5-1

Improper Control of Generation of Code in Twig Rendered Views in Shopware

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

• Обновитесь до 6.4.20.1

Session Fixation in alextselegidis/easyappointments

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

• Обновитесь до 1.5.0

Improper Access Control in alextselegidis/easyappointments

Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

• Обновитесь до 1.5.0

Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

• Обновитесь до 1.5.0

Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments

Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

• Обновитесь до 1.5.0