https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 18:29:32 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-01708 bdu:2020-01708 https://cve.radiocsirt.org/vuln/bdu:2020-01708 https://cve.radiocsirt.org/vuln/certfr-2019-avi-199 certfr-2019-avi-199 https://cve.radiocsirt.org/vuln/certfr-2019-avi-199 https://cve.radiocsirt.org/vuln/cnvd-2019-14071 cnvd-2019-14071 https://cve.radiocsirt.org/vuln/cnvd-2019-14071 https://cve.radiocsirt.org/vuln/euvd-2026-54627 EUVD-2026-54627 https://cve.radiocsirt.org/vuln/euvd-2026-54627 https://cve.radiocsirt.org/vuln/fkie_cve-2019-11831 <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-11831 https://cve.radiocsirt.org/vuln/ghsa-xv7v-rf6g-xwrc <p><strong>Affected:</strong> Packagist: typo3/phar-stream-wrapper, Packagist: drupal/core, Packagist: drupal/drupal</p> <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> <p><strong>Affected:</strong> Packagist: typo3/phar-stream-wrapper, Packagist: drupal/core, Packagist: drupal/drupal</p> <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> https://cve.radiocsirt.org/vuln/ghsa-xv7v-rf6g-xwrc https://cve.radiocsirt.org/vuln/gsd-2019-11831 gsd-2019-11831 https://cve.radiocsirt.org/vuln/gsd-2019-11831 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-11831 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7</p> <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7</p> <p>The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-11831