Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS25 NOV 2022
Browsershot version 3.57.3 vulnerable to improper input validation
fixed in 3.57.4
28 SEP 2022
Possibility to load a template outside a configured directory when using the filesystem loader
fixed in 1.44.7 · 2.15.3 · 3.4.3
22 SEP 2022
Craft CMS Cross-site Scripting vulnerability
fixed in 3.7.51 · 4.2.1
17 SEP 2022
Craft CMS Stored Cross-site Scripting in User Addresses Title
fixed in 4.2.1
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts
fixed in 3.7.55.2 · 4.2.1
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page
fixed in 4.2.1
19 JUL 2022
Dompdf before v2.0.0 vulnerable to chroot check bypass
fixed in 2.0.0
23 JUN 2022
20 JUN 2022
CURLOPT_HTTPAUTH option not cleared on change of origin
fixed in 6.5.8 · 7.4.5
Change in port should be considered a change in origin
fixed in 6.5.8 · 7.4.5
13 JUN 2022
Cross-site Scripting in SEOmatic plugin
fixed in 3.4.11
9 JUN 2022
Failure to strip the Cookie header on change in host or HTTP downgrade
fixed in 6.5.7 · 7.4.4
Fix failure to strip Authorization header on HTTP downgrade
fixed in 6.5.7 · 7.4.4
25 MAY 2022
24 MAY 2022
browsershot local file inclusion vulnerability
fixed in 3.40.1
SEOmatic for CraftCMS allows Server-Side Template Injection
fixed in 3.2.49
SEOmatic for CraftCMS allows Server-Side Template Injection
fixed in 3.3.0
php-shellcommand command injection vulnerability
fixed in 1.6.1
17 MAY 2022
HTML Purifier allows remote attackers to obtain sensitive information
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.