X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=release-notes%2F5.19.2.md;h=24e9f4de926e2a1f9b89f6b85d79c2ba0af0b182;hb=11b2e4a03f0fca2d8cf490fc2c9227b5b221f503;hp=2766086b252117a71f4603ef30a5fd138cce7a87;hpb=9c9fdd0cf113a6c53f13c0a1ee35c2c051e1bc5c;p=civicrm-core.git diff --git a/release-notes/5.19.2.md b/release-notes/5.19.2.md index 2766086b25..24e9f4de92 100644 --- a/release-notes/5.19.2.md +++ b/release-notes/5.19.2.md @@ -20,12 +20,12 @@ Released November 20, 2019 ## Security advisories -- **[CIVI-SA-2019-19](https://civicrm.org/advisory/civi-sa-2019-19-sqli-in-dedupefind)**: SQLI in "dedupefind" -- **[CIVI-SA-2019-20](https://civicrm.org/advisory/civi-sa-2019-20-privilege-escalation-via-leaked-key)**: Privilege escalation via leaked key -- **[CIVI-SA-2019-21](https://civicrm.org/advisory/civi-sa-2019-21-poi-saved-search-and-report-instance-apis)**: POI via "Saved Search" and "Report Instance" APIs -- **[CIVI-SA-2019-22](https://civicrm.org/advisory/civi-sa-2019-22-xss-in-dashboard-titles)**: XSS in dashboard titles -- **[CIVI-SA-2019-23](https://civicrm.org/advisory/civi-sa-2019-23-incorrect-storage-encoding-for-apiv4)**: Incorrect storage encoding for APIv4 -- **[CIVIEXT-SA-2019-02](https://civicrm.org/advisory/civiext-sa-2019-02-xss-in-civicase-v5-extension)**: XSS in CiviCase v5 extension +- **[CIVI-SA-2019-19](https://civicrm.org/advisory/civi-sa-2019-19-sqli-in-dedupefind): SQL injection in "dedupefind"** +- **[CIVI-SA-2019-20](https://civicrm.org/advisory/civi-sa-2019-20-privilege-escalation-via-leaked-key): Privilege escalation via leaked key** +- **[CIVI-SA-2019-21](https://civicrm.org/advisory/civi-sa-2019-21-poi-saved-search-and-report-instance-apis): PHP object injection via "Saved Search" and "Report Instance" APIs** +- **[CIVI-SA-2019-22](https://civicrm.org/advisory/civi-sa-2019-22-xss-in-dashboard-titles): Cross-site scripting in dashboard titles** +- **[CIVI-SA-2019-23](https://civicrm.org/advisory/civi-sa-2019-23-incorrect-storage-encoding-for-apiv4): Incorrect storage encoding for APIv4** +- **[CIVIEXT-SA-2019-02](https://civicrm.org/advisory/civiext-sa-2019-02-xss-in-civicase-v5-extension): Cross-site scripting in CiviCase v5 extension** ## Bugs resolved @@ -39,7 +39,9 @@ Released November 20, 2019 This release was developed by the following people, who participated in various stages of reporting, analysis, development, review, and testing: -Alan Dixon of Blackfly Solutions; Coleman Watts of CiviCRM; Daniel Compton of -Armadillo Sec Ltd; Eileen McNaughton of Wikimedia Foundation; Kevin Cristiano of -Tadpole Collective; Mark Burdett of Electronic Frontier Foundation; Patrick Figel -of Greenpeace CEE; Seamus Lee of Australian Greens; Tim Otten of CiviCRM +Alan Dixon of Blackfly Solutions; Coleman Watts of CiviCRM; Daniel Compton +of Armadillo Sec Ltd; Dave D; Eileen McNaughton of Wikimedia Foundation; +Karin Gerritsen of Semper IT; Kevin Cristiano of Tadpole Collective; Mark +Burdett of Electronic Frontier Foundation; Morgan Robinson of Palante +Technology Cooperative; Patrick Figel of Greenpeace CEE; Seamus Lee of +Australian Greens; Tim Otten of CiviCRM \ No newline at end of file