Contao Cross-site Scripting vulnerabililty

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-5478 · ADVISORY
• contao/core commit 3123d65 · WEB
• contao.org/en/news/contao-3_5_32.html · WEB
• FriendsOfPHP/security-advisories · WEB
• contao/core · PACKAGE
• security.snyk.io/vuln/SNYK-PHP-CONTAOCORE-70397 · WEB

contao/core のその他の脆弱性

• GHSA-wq43-8r5p-w3mc高contao/core PHP object injection vulnerability allows for arbitrary code execution
• GHSA-wxxw-5gq6-j2g5緊急 9.0contao/core Insufficient input validation allows for code injection and remote execution
• CVE-2018-10125中 6.1Contao before 4.5.7 has XSS in the system log.
• CVE-2012-4383高 8.8contao prior to 2.11.4 has a sql injection vulnerability
• CVE-2019-10641緊急 9.8Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.