If you think that you have found a security issue in Sylius, please do not use the issue tracker and do not post it publicly. Instead, all security issues must be sent to security@sylius.com.
Please refer to the release process.
Security: Sylius/Sylius
Security
SECURITY.md
-
Improper sanitize of SVG files during content upload ('Cross-site Scripting') in Sylius/SyliusGHSA-4qrp-27r3-66fj published
Mar 14, 2022 by lchruscielLow -
Reset password token not set to null after reset passwordGHSA-mf3v-f2qq-pf9g published
Mar 14, 2022 by lchruscielLow -
Missing HTTP headers to avoid login forms clickjackingGHSA-4jp3-q2qm-9fmw published
Mar 14, 2022 by lchruscielModerate -
Exposure of sensitive information by using the back button after logging out in sylius/syliusGHSA-7563-75j9-6h5p published
Mar 14, 2022 by lchruscielModerate -
List of order ids, number, items total and token value exposed for unauthorized uses via new APIGHSA-rpxh-vg2x-526v published
Jun 28, 2021 by pamilModerate -
Ability to switch customer email address on account detail page and stay verifiedGHSA-6gw4-x63h-5499 published
Oct 19, 2020 by lchruscielLow -
Ability to switch channels via GET parameter enabled in production environmentsGHSA-prg5-hg25-8grq published
Jan 27, 2020 by pamilLow -
Internal exception message exposure for login actionGHSA-3r8j-pmch-5j2h published
Dec 5, 2019 by pamilLow
Learn more about advisories related to Sylius/Sylius in the GitHub Advisory Database