contao/core-bundle

4 results · Clear filters · Feed

• Critical 9.8
  CVE-2019-11512

  Contao SQL injection in the file manager

  Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.

  contao/core-bundle contao/contao Packagist
  Jul 9, 2019
• Critical 9.8
  CVE-2017-16558

  Contao SQL injection in the backend and listing module

  Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

  contao/core-bundle contao/contao contao/listing-bundle Packagist
  Apr 25, 2019
• Critical 9.8
  CVE-2019-10643

  Contao Does Not Expire Tokens Correctly

  Contao 4.7 allows Use of a Key Past its Expiration Date.

  contao/core-bundle contao/contao Packagist
  Apr 17, 2019
• Critical 9.8
  CVE-2019-10641

  Contao Does Not Invalidate Existing Sessions When Password Changes

  Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

  contao/core-bundle contao/contao contao/core Packagist
  Apr 17, 2019