Advisories for packages from symfony

Listing reported advisories for packages from symfony sorted by their report date.

Symfony has an Authentication Bypass via RememberMe
GitHub

symfony/security-http

>= 6.0.0-BETA1, < 6.4.15 · >= 7.0.0-BETA1, < 7.1.8 · >= 5.3.0, < 5.4.47

2024-11-13 18:29:05
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
GitHub

symfony/http-client

>= 6.0.0, < 6.4.15 · >= 6.0.0, < 6.4.14 · >= 4.3.0, < 5.4.47 · >= 4.3.0, < 5.4.46 · >= 7.0.0, < 7.1.8 · >= 7.0.0, < 7.1.7

2024-11-13 16:27:49
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
FriendsOfPHP

symfony/security-http

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-13 08:00:00
CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient
FriendsOfPHP

symfony/http-client

>=6.4.0, <6.4.15 · >=5.4.0, <5.4.47 · >=7.1.0, <7.1.8 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.4.0, <5.0.0 · >=4.3.0, <4.4.0

2024-11-13 08:00:00
Symfony vulnerable to command execution hijack on Windows with Process class
GitHub

symfony/process

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:57
Symfony vulnerable to open redirect via browser-sanitized URLs
GitHub

symfony/http-foundation

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:12
Symfony has an incorrect response from Validator when input ends with `\n`
GitHub

symfony/symfony

>= 6.0.0, < 6.4.11 · >= 7.0.0, < 7.1.4 · < 5.4.43

2024-11-06 15:21:09
Symfony's `Security::login` does not take into account custom `user_checker`
GitHub

symfony/security-bundle

>= 7.0.0, < 7.0.10 · >= 6.2.0, < 6.4.10 · >= 7.1.0, < 7.1.3

2024-11-06 15:13:43
Symfony allows changing the environment through a query
GitHub

symfony/runtime

>= 6.0.0, < 6.4.14 · >= 5.3.0, < 5.4.46 · >= 7.0.0, < 7.1.7

2024-11-06 15:11:11
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/process

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/runtime

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/http-foundation

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/validator

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
CVE-2024-50343: Incorrect response from Validator when input ends with ` `
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.11 · >=5.4.0, <5.4.43 · >=7.1.0, <7.1.4 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-08-30 08:00:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/symfony

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
CVE-2024-50341: Security::login does not take into account custom user_checker
FriendsOfPHP

symfony/security-bundle

>=7.0.0, <7.0.10 · >=6.4.0, <6.4.10 · >=7.1.0, <7.1.3 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0

2024-07-17 08:00:00
symfony/validator XML Entity Expansion vulnerability
GitHub

symfony/validator

>= 2.0.0, < 2.0.17

2024-05-30 13:10:54
symfony/translation XML Entity Expansion vulnerability
GitHub

symfony/translation

>= 2.0.0, < 2.0.17

2024-05-30 13:02:44
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
GitHub

symfony/symfony

>= 2.0.0, < 2.3.19 · >= 2.5.0, < 2.5.4 · >= 2.4.0, < 2.4.9

2024-05-30 13:00:02
Symfony2 improper IP based access control
GitHub

symfony/symfony

>= 2.0.0, < 2.0.19 · >= 2.1.0, < 2.1.4

2024-05-30 12:35:52
Symfony XML Entity Expansion security vulnerability
GitHub

symfony/symfony

>= 2.0.0, < 2.0.17

2024-05-30 12:21:01
Symfony XML decoding attack vector through external entities
GitHub

symfony/symfony

>= 2.0.0, < 2.0.11

2024-05-30 12:17:21
Symfony may allow a user to switch to using another user's identity
GitHub

symfony/symfony

>= 2.0.0, < 2.0.6

2024-05-30 00:56:01
Symfony XML decoding attack vector through external entities
GitHub

symfony/serializer

>= 2.0.0, < 2.0.11

2024-05-30 00:52:21
Symfony XXE security vulnerability
GitHub

symfony/routing

>= 2.0.0, < 2.0.17

2024-05-30 00:49:55
Symfony allows direct access of ESI URLs behind a trusted proxy
GitHub

symfony/http-kernel

>= 2.0.0, < 2.3.19 · >= 2.5.0, < 2.5.4 · >= 2.4.0, < 2.4.9

2024-05-30 00:46:54
Symfony has unsafe methods in the Request class
GitHub

symfony/http-foundation

>= 2.4.0, < 2.5.11 · >= 2.0.0, < 2.3.27 · >= 2.6.0, < 2.6.6

2024-05-30 00:42:19
Symfony has a security issue when parsing the Authorization header
GitHub

symfony/http-foundation

>= 2.0.0, < 2.3.19 · >= 2.5.0, < 2.5.4 · >= 2.4.0, < 2.4.9

2024-05-30 00:41:19
Symfony vulnerable to denial of service via a malicious HTTP Host header
GitHub

symfony/http-foundation

>= 2.0.0, < 2.3.19 · >= 2.5.0, < 2.5.4 · >= 2.4.0, < 2.4.9

2024-05-30 00:38:38
Symfony2 security issue when the trust proxy mode is enabled
GitHub

symfony/http-foundation

>= 2.0.0, < 2.0.19 · >= 2.1.0, < 2.1.4

2024-05-30 00:34:49
Code injection in the way Symfony implements translation caching in FrameworkBundle
GitHub

symfony/framework-bundle

>= 2.0.0, < 2.3.19 · >= 2.0.0, < 2.3.18 · >= 2.5.0, < 2.5.4 · >= 2.5.0, < 2.5.2 · >= 2.4.0, < 2.4.9 · >= 2.4.0, < 2.4.8

2024-05-30 00:21:26
Symfony XML Entity Expansion security vulnerability
GitHub

symfony/dependency-injection

>= 2.0.0, < 2.0.17

2024-05-29 19:59:15
Symfony Open Redirect
GitHub

symfony/security-http

>= 2.7.38, < 2.7.50 · >= 4.0.0, < 4.0.15 · >= 3.0.0, < 3.4.20 · >= 3.0.0, < 3.4.19 · >= 2.8.0, < 2.8.49 · >= 4.2.0, < 4.2.1 · >= 4.1.0, < 4.1.9

2024-04-25 22:12:42
Symfony SSRF Vulnerability via Form Component
GitHub

symfony/form

>= 3.3.0, < 3.3.13 · >= 3.0.0, < 3.2.14 · >= 2.8.0, < 2.8.31 · >= 2.7.0, < 2.7.38

2024-04-25 22:12:31
Symfony Authentication Bypass
GitHub

symfony/security-core

>= 3.0.0, < 3.3.17 · >= 2.8.0, < 2.8.37 · >= 4.0.0, < 4.0.7 · >= 3.4.0, < 3.4.7

2024-04-25 22:11:26
Symphony Vulnerable to PHP Code Injection via YAML Parsing
GitHub

symfony/symfony

>= 2.0.0, < 2.0.22

2024-04-25 22:09:30
Symfony Vulnerable to PHP Eval Injection
GitHub

symfony/symfony

>= 2.4.0, < 2.5.11 · >= 2.0.0, < 2.3.27 · >= 2.6.0, < 2.6.6

2024-04-25 22:09:05
Symphony Denial of Service Via Overlong Usernames
GitHub

symfony/security-http

>= 2.4.0, < 2.7.13 · >= 2.3.0, < 2.3.41 · >= 3.0.0, < 3.0.6 · >= 2.8.0, < 2.8.6

2024-04-25 22:08:03
Symfony Denial of Service Via Long Password Hashing
GitHub

symfony/symfony

>= 2.1.0, < 2.1.13 · >= 2.0.0, < 2.0.25 · >= 1.0.0, < 1.10.0 · >= 2.3.0, < 2.3.6 · >= 2.2.0, < 2.2.9

2024-04-25 22:04:18
Prevent user enumeration using Guard or the new Authenticator-based Security
GitHub

symfony/security

>= 2.11.0, < 2.11.3 · >= 1.30.0, < 1.31.1 · >= 1.27.0, < 1.29.2 · >= 4.0.0, < 4.4.24 · >= 4.0.0, < 4.4.23 · >= 2.8.0, < 3.4.49 · >= 2.8.0, < 3.4.48 · >= 2.0.0, < 2.10.7 · >= 5.1.0, < 5.2.8 · >= 5.0.0, < 5.2.9 · >= 5.0.0, < 5.2.8

2024-02-26 12:40:00
Symfony Cross-site Scripting (XSS) vulnerability
GitHub

symfony/framework-bundle

>= 8.6.0, < 8.6.15 · >= 8.0.0, < 8.5.15 · >= 4.0.0, < 4.1.12 · >= 3.0.0, < 3.4.26 · >= 2.8.0, < 2.8.50 · >= 2.7.0, < 2.7.51 · >= 4.2.0, < 4.2.7 · < 8.5.15

2024-02-14 15:22:39
Symfony Incorrect Access Control
GitHub

symfony/security-core

>= 3.2.10, < 3.2.12 · >= 2.8.23, < 2.8.25 · >= 2.7.30, < 2.7.32 · >= 3.2.0, < 3.2.12 · >= 2.8.0, < 2.8.25 · >= 2.7.0, < 2.7.32 · >= 3.3.3, < 3.3.5 · >= 3.3.0, < 3.3.5 · >= 3.2, <= 3.2.10 · >= 2.8, <= 2.8.23 · >= 2.7, <= 2.7.30 · >= 3.3, <= 3.3.3

2024-02-08 19:47:43
Symfony Cryptographic Vulnerability
GitHub

symfony/security-core

>= 2.4.0, < 2.6.13 · >= 2.3.0, < 2.3.37 · >= 2.7.0, < 2.7.9 · >= 2.6, < 2.6.13 · >= 2.7, < 2.7.9 · < 2.3.37

2024-02-08 19:38:27
Symfony CSRF Token Fixation
GitHub

symfony/symfony

>= 4.0.0, < 4.0.11 · >= 3.4.0, < 3.4.11 · >= 3.3.0, < 3.3.17 · >= 3.0.0, < 3.3.17 · >= 2.8.0, < 2.8.41 · >= 2.7.0, < 2.7.48 · >= 4.0, < 4.0.11 · >= 3.4, < 3.4.11 · >= 3.3, < 3.3.17 · >= 2.8, < 2.8.41 · >= 2.7, < 2.7.48

2024-02-08 19:30:03
Symfony Session Fixation Vulnerability
GitHub

symfony/symfony

>= 4.0.0, < 4.0.11 · >= 3.4.0, < 3.4.11 · >= 3.3.0, < 3.3.17 · >= 3.0.0, < 3.3.17 · >= 2.8.0, < 2.8.41 · >= 2.7.0, < 2.7.48 · >= 4.0, < 4.0.11 · >= 3.4, < 3.4.11 · >= 3.3, < 3.3.17 · >= 2.8, < 2.8.41 · >= 2.7, < 2.7.48

2024-02-08 19:28:14
« Previous Next »

Showing 1 to 50 of 246 results

1 2 3 4 5