Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2019-11831
9.8
CRITICALCVSS v3
Published
May 9, 2019
CVSS v2
7.5 HIGH
Affected
8 projects
Assigned by
MITRE
Severity scale
010
Description
The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
TYPO3/phar-stream-wrapper
GitHubInterceptors for PHP's native phar:// stream handling in order to enhance security.
GitHubInterceptors for PHP's native phar:// stream handling in order to enhance security.>= 2.0.0, < 2.1.1, >= 3.0.0, < 3.1.1NVD
drupal/drupalGitHubVerbatim mirror of the git.drupal.org repository for Drupal core. Please see the https://github.com/drupal/drupal#contributing. PRs are not accepted on GitHub.
GitHubVerbatim mirror of the git.drupal.org repository for Drupal core. Please see the https://github.com/drupal/drupal#contributing. PRs are not accepted on GitHub.>= 8.7.0, < 8.7.1, >= 8.6.0, < 8.6.16, >= 7.0, < 7.67NVD
RubyGems
NPM
Docker Hub