Rezultati pretraživanja za 'Proizvođač: yiiframework'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2023-50708 | 9.8 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` si | 2024-01-08 17:42:45 | 2023-12-22 19:15:08 |
| CVE-2023-50714 | 8.8 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` | 2024-01-08 15:12:05 | 2023-12-22 19:15:09 |
| CVE-2022-41922 | 9.8 | `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27. | 2022-11-30 13:44:00 | 2022-11-23 18:15:00 |
| CVE-2021-3689 | 5.0 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator | 2022-04-25 19:59:00 | 2021-08-10 11:15:00 |
| CVE-2021-3692 | 5.0 | yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator | 2022-04-25 19:58:00 | 2021-08-10 17:15:00 |
| CVE-2020-15148 | 7.5 | Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked ad | 2020-09-22 15:39:00 | 2020-09-15 19:15:00 |
| CVE-2018-6010 | 5.0 | In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, a | 2020-08-24 17:37:00 | 2018-01-22 22:29:00 |
| CVE-2018-20745 | 4.3 | Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems. | 2019-02-20 16:26:00 | 2019-01-28 08:29:00 |
| CVE-2018-8074 | 6.8 | Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension. | 2018-04-20 13:08:00 | 2018-03-21 18:29:00 |
| CVE-2018-7269 | 7.5 | The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array in | 2018-04-20 13:03:00 | 2018-03-21 18:29:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/3
Zapisa po stranici: