Brussels, Belgium 2023
Friday 2nd June 2023
Manchester, UK 2023
29th November - 8th December 2023
More Greetings - Personalised Strings for all Contacts 1.1.0
<extension key="de.systopia.moregreetings" type="module">
<file>moregreetings</file>
<name>More Greeting Options</name>
<description>Extension to allow additional, customised greetings</description>
<license>AGPL-3.0</license>
<maintainer>
<author>SYSTOPIA</author>
<email>endres@systopia.de</email>
</maintainer>
<urls>
<url desc="Main Extension Page">https://github.com/systopia/de.systopia.moregreetings</url>
<url desc="Documentation">https://github.com/systopia/de.systopia.moregreetings</url>
<url desc="Support">https://github.com/systopia/de.systopia.moregreetings/issues</url>
<url desc="Licensing">http://www.gnu.org/licenses/agpl-3.0.html</url>
</urls>
<releaseDate>2023-02-27</releaseDate>
<version>1.1.0</version>
<develStage>stable</develStage>
<compatibility>
<ver>5.0</ver>
</compatibility>
<comments></comments>
<civix>
<namespace>CRM/Moregreetings</namespace>
</civix>
</extension>
CiviCRM + WordPress + The Island theme
Recent version of CiviCRM with the The Island theme on WordPress. Minimal read-only demo.
To login: username is "demo" and password is "demo123".
We provide turn-key CiviCRM hosting (no installation costs, regular CiviCRM upgrades, backups, secure https, 24/7 monitoring, no lock-in) with Drupal7, Drupal8 and WordPress, in French, English or bilingual configurations.
CIVI-SA-2023-06: Dompdf 2.0.3
The "dompdf" library has a vulnerability which allows remote code execution. It may be exploited by some backend users.
CIVI-SA-2023-05: Quick Add Widget
The CiviCRM-WordPress module includes a "Quick Add" widget that can be used to trick another user into executing arbitrary HTML and Javascript.
(This vulnerability is similar to "stored cross-site scripting". However, exploiting it requires the backend privilege access CiviCRM, so it can only be exploited by internal users.)
CIVI-SA-2023-04: File Type Restrictions
CiviCRM's file-upload mechanism includes a guard to limit the range of accepted file-types. However, the guard is too relaxed - in some configurations, this enables a less-privileged data-administrator to execute arbitrary code.
CiviSEPA 1.7.0
<extension key="org.project60.sepa" type="module">
<file>sepa</file>
<name>SEPA Direct Debit</name>
<description>This extension provides SEPA Direct Debit processing.</description>
<license>aGPL3</license>
<maintainer>
<author>B. Endres</author>
<email>endres@systopia.de</email>
</maintainer>
<releaseDate>2023-01-11</releaseDate>
<version>1.7.0</version>
<develStage>stable</develStage>
<compatibility>
<ver>5.19</ver>
<ver>5.28</ver>
<ver>5.43</ver>
</compatibility>
<urls>
<url desc="Main Extension Page">https://github.com/Project60/org.project60.sepa</url>
<url desc="Documentation">https://docs.civicrm.org/civisepa</url>
<url desc="Support">https://github.com/Project60/org.project60.sepa/issues</url>
<url desc="Licensing">http://www.gnu.org/licenses/agpl-3.0.html</url>
</urls>
<comments>This module is the merge of Xaviers Dutoit's (xavier@tttp.eu) and Björn Endres' (endres@systopia.de) Project60 branches.</comments>
<classloader>
<psr4 prefix="Civi\" path="Civi"/>
</classloader>
<civix>
<namespace>CRM/Sepa</namespace>
<format>22.05.2</format>
</civix>
<mixins>
<mixin>menu-xml@1.0.0</mixin>
<mixin>mgd-php@1.0.0</mixin>
<mixin>setting-php@1.0.0</mixin>
</mixins>
</extension>
CIVI-SA-2023-03: Asset Builder XSS
Asset Builder allows CiviCRM and its extensions to generate dynamic assets. A vulnerability allowed third-parties to trick it into generating assets with unintended inputs.
Exploiting this vulnerability depends on several details (e.g. the asset data-types, input-parameters, and web-domain policies). For the specific assets and configurations that we tested, attacks were substantively constrained by the browsers' "Same Origin Policy". However, other assets and other configurations could be impacted more severely.
CIVI-SA-2023-02: CiviEvent XSS
CiviEvent included a vector for reflected cross-site-scripting (XSS) attacks.
