CIVI-SA-2022-06: Dompdf 1.2.1
Published
2022-04-06 12:00
The "dompdf" library has a vulnerability which allows remote code execution. It may be exploited by some backend users.
CIVI-SA-2022-05: CKEditor v4.18
Published
2022-03-16 12:00
CKEditor had a vulnerability that could allow execution of Javascript code.
The exact degree of exploitability for CiviCRM has not been determined.
CIVI-SA-2022-04: jQuery UI v1.13
Published
2022-03-16 12:00
jQuery UI v1.12 included multiple cross-site scripting vulnerabilities.
It has not been demonstrated that CiviCRM specifically is exploitable. However, it is possible that third-party extensions could use jQuery UI in a vulnerable fashion.
CIVI-SA-2022-03: Permission Advice
Published
2022-03-16 12:00
This is not a security vulnerability. It is a mitigation to protect against misconfiguration.
CiviCRM includes a large number of configurable permissions. Administrators may assign these permissions to various users and roles. This is powerful functionality that accommodates diverse needs, but it provides the opportunity for misconfiguration.
Misconfigurations may arise for a few reasons, such as:
CIVI-SA-2022-02: CiviEvent Importer, SQL Injection
Published
2022-03-16 12:00
When importing "Participant" records for CiviEvent, some inputs were not suitably escaped.
CIVI-SA-2022-01: CiviContribute Access Bypass
Published
2022-03-16 12:00
When accessing the Contribution View page insufficient permission checking was occurring which meant that if you knew the url and had the access CiviCRM permission you would be able to view contribution information that you shouldn't have.
I Stand With Ukraine
Published
2022-03-14 03:25
A few weeks prior to 24 February, I’d given up reading the news. It was a very happy time. Since Russia’s invasion of Ukraine, it’s been hard not to jump back into my Google news feed and periodically check in at NPR. Given the rise of misinformation over the past few years, it’s hard to know what is accurate and what isn’t, so much of what I read I take with a grain of salt.
Updated Privacy Policy & Site Statistics
Published
2022-01-31 03:59
In the fall of 2021, the CiviCRM Core Team revised and published a privacy policy on https://civicrm.org that meets the requirements set forth by both the European General Data Protection Regulation and the California Consumer Privacy Act. The revised policy is available at https://civicrm.org/privacy-policy
2021 Annual report
Published
2022-01-17 06:46
The 2021 annual report for the CiviCRM Core Team is now live at https://civicrm.org/annual-report just in time for the Community Round Tables tomorrow.
0.15
Extension
Release Date
Release Version
0.15
Release Status
Stable
Release CiviCRM Compatibility
XML
<?xml version="1.0"?>
<extension key="finsburypark" type="module">
<file>finsburypark</file>
<name>Finsbury Park Theme</name>
<description>Lightweight cross-CMS CiviCRM admin theme.</description>
<license>AGPL-3.0</license>
<maintainer>
<author>Nicol Wistreich</author>
<email>nic@visuali.st</email>
</maintainer>
<urls>
<url desc="Main Extension Page">https://lab.civicrm.org/extensions/finsburypark</url>
<url desc="Support">https://visuali.st</url>
<url desc="Licensing">http://www.gnu.org/licenses/agpl-3.0.html</url>
</urls>
<releaseDate>2021-25-11</releaseDate>
<version>0.15</version>
<develStage>beta</develStage>
<compatibility>
<ver>5.0</ver>
</compatibility>
<comments>A cross-CMS CiviCRM admin theme.</comments>
<classloader>
<psr4 prefix="Civi\" path="Civi"/>
</classloader>
<civix>
<namespace>CRM/Finsburypark</namespace>
</civix>
</extension>
<extension key="finsburypark" type="module">
<file>finsburypark</file>
<name>Finsbury Park Theme</name>
<description>Lightweight cross-CMS CiviCRM admin theme.</description>
<license>AGPL-3.0</license>
<maintainer>
<author>Nicol Wistreich</author>
<email>nic@visuali.st</email>
</maintainer>
<urls>
<url desc="Main Extension Page">https://lab.civicrm.org/extensions/finsburypark</url>
<url desc="Support">https://visuali.st</url>
<url desc="Licensing">http://www.gnu.org/licenses/agpl-3.0.html</url>
</urls>
<releaseDate>2021-25-11</releaseDate>
<version>0.15</version>
<develStage>beta</develStage>
<compatibility>
<ver>5.0</ver>
</compatibility>
<comments>A cross-CMS CiviCRM admin theme.</comments>
<classloader>
<psr4 prefix="Civi\" path="Civi"/>
</classloader>
<civix>
<namespace>CRM/Finsburypark</namespace>
</civix>
</extension>
