#php

### Description Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. The security issue happens when all these conditions are met: * The sandbox is disabled globally; * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance; * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled). ### Resolution The patch ensures that the sandbox security checks are always run at runtime. ### Credits We would like to thank Fabien Potencier for reporting and fixing the issue.

Debian Linux Security Advisory 5767-1 - Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code.

PPDB version 2.4-update 6118-1 suffers from a remote blind SQL injection vulnerability.

POMS version 1.0 suffers from an ignored default credential vulnerability.

Pharmacy Management System version version 1.0 suffers from an ignored default credential vulnerability.

PDF Generator Web Application version 1.0 suffers from an ignored default credential vulnerability.

Park Ticketing Project version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Online Travel Agency System version 1.0 suffers from an ignored default credential vulnerability.

Online Tours and Travels Management System version 1.0 suffers from an ignored default credential vulnerability.

C-MOR Video Surveillance versions 5.2401 and 6.00PL01 suffer from a command injection vulnerability.