Security Digest · page 3 of 3
Critical Composer (PHP) advisories (page 3)
244 critical advisories for Composer (PHP) packages since October 2023, newest first. Check your project with composer audit.
- propel/propel1 SQL injection possible with limit() on MySQL GHSA-7g7c-qhf3-x59p CVSS 9.8 Critical
propel/propel1>= 1, <= 1.7.1 → fixed in 1.7.2 - Flow Swift Mailer package Remote code execution GHSA-rq6q-hjvh-5mwh
neos/swiftmailer< 5.4.5 → fixed in 5.4.5 - namshi/jose - Verification bypass GHSA-4rr6-gf59-ggw5
namshi/jose< 2.2.0 → fixed in 2.2.0 - contao/core Insufficient input validation allows for code injection and remote execution GHSA-wxxw-5gq6-j2g5 CVSS 9.0 Critical
contao/core>= 2.0.0, < 2.11.17 → fixed in 2.11.17;contao/core>= 3.0.0, < 3.2.9 → fixed in 3.2.9 - Laravel RCE vulnerability in "cookie" session driver GHSA-qm5c-m76r-2hfr CVSS 9.9 Critical
laravel/framework>= 4.1.0, < 6.18.31 → fixed in 6.18.31;laravel/framework>= 7.0.0, < 7.22.4 → fixed in 7.22.4 - Magento Patch SUPEE-10752 - Multiple security enhancements vulnerabilities GHSA-prpf-cj87-hwvr
magento/community-edition< 1.9.3.9 → fixed in 1.9.3.9 - Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-jjx7-8462-w4m4
drupal/drupal>= 8.0.0, < 8.5.8 → fixed in 8.5.8;drupal/drupal>= 8.6.0, < 8.6.2 → fixed in 8.6.2 - Drupal core Remote Code Execution GHSA-jf8c-36vw-98x4
drupal/drupal>= 7.0, < 7.60 → fixed in 7.60;drupal/drupal>= 8.0.0, < 8.5.8 → fixed in 8.5.8;drupal/drupal>= 8.6.0, < 8.6.2 → fixed in 8.6.2 - ADOdb SQL injection vulnerability GHSA-h63c-xvpf-264j
adodb/adodb-php< 5.20.11 → fixed in 5.20.11 - firebase/php-jwt: "None" Algorithm treated as valid on tokens GHSA-h533-5v22-8vcp
firebase/php-jwt< 2.0.0 → fixed in 2.0.0 - Magento Open Source Security Advisory: Patch SUPEE-10975 GHSA-cv25-3pxr-4q7x
magento/community-edition>= 1.9.0.0, < 1.14.4.0 → fixed in 1.14.4.0 - gree/jose - "None" Algorithm treated as valid in tokens GHSA-9gxv-x7rp-r2hc
gree/jose< 2.2.1 → fixed in 2.2.1 - Magento RCE,XSS and other vulnerabilities GHSA-8j7c-682x-r9f2
magento/community-edition>= 2.1, < 2.1.16 → fixed in 2.1.16;magento/community-edition>= 2.2, < 2.2.7 → fixed in 2.2.7 - Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution GHSA-7v68-3pr5-h3cr
drupal/core>= 8.0.0, < 8.5.8 → fixed in 8.5.8;drupal/core>= 8.6.0, < 8.6.2 → fixed in 8.6.2 - Magento Security enhancements that help close RCE,XSS,CSRF and other vulnerabilities GHSA-6wm4-3rjj-c8xx
magento/community-edition>= 1.5.0.0, < 1.9.4.0 → fixed in 1.9.4.0 - Doctrine SQL injection vulnerability GHSA-6q9v-4hq6-5m67
doctrine/orm>= 2.0.0, < 2.0.3 → fixed in 2.0.3;doctrine/orm>= 1.0.0, < 1.2.4 → fixed in 1.2.4 - Drupal core Remote Code Execution GHSA-6mgp-v5cm-ghg5
drupal/core>= 7.0, < 7.60 → fixed in 7.60;drupal/core>= 8.0.0, < 8.5.8 → fixed in 8.5.8;drupal/core>= 8.6.0, < 8.6.2 → fixed in 8.6.2 - Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities GHSA-5gmh-85x8-5cx7
magento/community-edition>= 2.1, < 2.1.14 → fixed in 2.1.14;magento/community-edition>= 2.2, < 2.2.5 → fixed in 2.2.5 - Mautic is vulnerable to XSS vulnerability CVE-2020-35125 CVSS 9.6 Critical
mautic/core< 2.16.5 → fixed in 2.16.5;mautic/core>= 3.0.0, < 3.2.4 → fixed in 3.2.4 - Laravel RCE vulnerability in "cookie" session driver GHSA-2ffv-r4r9-r8xr
illuminate/cookie>= 4.1.0, < 6.18.31 → fixed in 6.18.31;illuminate/cookie>= 7.0.0, < 7.22.4 → fixed in 7.22.4 - codeigniter/framework SQL injection in ODBC database driver GHSA-27qr-636m-wxg2 CVSS 10.0 Critical
codeigniter/framework< 3.1.0 → fixed in 3.1.0 - Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability GHSA-26hq-7286-mg8f
magento/community-edition>= 1.9.0.0, < 1.14.3.2 → fixed in 1.14.3.2 - Cockpit CMS contains an arbitrary file upload vulenrability CVE-2024-4825 CVSS 9.8 Critical
cockpit-hq/cockpit< 2.7.0 → fixed in 2.7.0 - PrestaShop cross-site scripting via customer contact form in FO, through file upload CVE-2024-34716 CVSS 9.6 Critical
prestashop/prestashop>= 8.1.0, < 8.1.6 → fixed in 8.1.6 - Blind XSS Leading to Froxlor Application Compromise CVE-2024-34070 CVSS 9.6 Critical
froxlor/froxlor< 2.1.9 → fixed in 2.1.9 - Zenario uses Twig filters insecurely in the Twig Snippet plugin CVE-2024-34461 CVSS 9.8 Critical
tribalsystems/zenario< 9.5.60437 → fixed in 9.5.60437 - PHPECC vulnerable to multiple cryptographic side-channel attacks GHSA-346h-749j-r28w CVSS 9.1 Critical
mdanter/ecc>= 0, <= 1.0.0 → no fix listed - Zend Framework SQL injection vulnerability CVE-2014-8089 CVSS 9.8 Critical
zendframework/zendframework1>= 1.12.0, < 1.12.9 → fixed in 1.12.9;zendframework/zend-db>= 2.0.0, < 2.0.99 → fixed in 2.0.99;zendframework/zend-db>= 2.1.0, < 2.1.99 → fixed in 2.1.99; +6 more packages - Drupal Core Remote Code Execution Vulnerability CVE-2018-7602 CVSS 9.8 Critical
drupal/core>= 7.0, < 7.59 → fixed in 7.59;drupal/core>= 8.0, < 8.4.8 → fixed in 8.4.8;drupal/core>= 8.5, < 8.5.3 → fixed in 8.5.3; +3 more packages - WWBN AVideo Remote Code Execution CVE-2024-31819 CVSS 9.3 Critical
wwbn/avideo>= 12.4, <= 14.2 → fixed in 14.3 - Gleez Cms Server Side Request Forgery (SSRF) vulnerability CVE-2021-27312 CVSS 9.0 Critical
gleez/cms<= 1.2.0 → no fix listed - Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE GHSA-97m3-52wr-xvv2 CVSS 10.0 Critical
phenx/php-svg-lib< 0.5.2 → fixed in 0.5.2 - Deserialization of Untrusted Data in Torrentpier CVE-2024-1651 CVSS 10.0 Critical
torrentpier/torrentpier<= 2.4.1 → no fix listed - Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions CVE-2024-25108 CVSS 9.9 Critical
pixelfed/pixelfed>= 0.10.4, < 0.11.11 → fixed in 0.11.11 - Blind SQL injection in shopware CVE-2024-22406 CVSS 9.3 Critical
shopware/core<= 6.5.7.3 → fixed in 6.5.7.4;shopware/platform<= 6.5.7.3 → fixed in 6.5.7.4 - Drupal Improper Access Control CVE-2019-6342 CVSS 9.8 Critical
drupal/core> 8.7.3, < 8.7.5 → fixed in 8.7.5;drupal/drupal> 8.7.3, < 8.7.5 → fixed in 8.7.5 - WWBN AVideo Insufficient Entropy vulnerbaility CVE-2023-49599 CVSS 9.8 Critical
wwbn/avideo<= 12.4 → no fix listed - plotly.js prototype pollution vulnerability CVE-2023-46308 CVSS 9.8 Critical
plotly/plotly.js< 2.25.2 → fixed in 2.25.2;plotly.js< 2.25.2 → fixed in 2.25.2 - PHPMemcachedAdmin Path Traversal vulnerability CVE-2023-6026 CVSS 9.8 Critical
elijaa/phpmemcacheadmin<= 1.3.0 → no fix listed - October CMS safe mode bypass using Twig sandbox escape CVE-2023-44382 CVSS 9.1 Critical
october/system>= 3.0.0, < 3.4.15 → fixed in 3.4.15 - Froxlor Improper Input Validation vulnerability CVE-2023-6069 CVSS 9.9 Critical
froxlor/froxlor< 2.1.0-beta1 → fixed in 2.1.0-beta1 - Json response for search reveals Solr credentials GHSA-v6xp-ccvx-w52m
ibexa/solr>= 4.5.0, < 4.5.4 → fixed in 4.5.4 - Json response for search reveals Solr credentials GHSA-7crc-r3wg-cfgf
ezsystems/ezplatform-solr-search-engine>= 3.3.0, < 3.3.15 → fixed in 3.3.15;ezsystems/ezplatform-solr-search-engine>= 2.0.0, < 2.0.2 → fixed in 2.0.2;ezsystems/ezplatform-solr-search-engine>= 1.7.0, < 1.7.12 → fixed in 1.7.12 - Cachet vulnerable to Authenticated Remote Code Execution CVE-2023-43661 CVSS 9.1 Critical
cachethq/cachet< 2.4 → fixed in 2.4