Advisories for packages from yiisoft

Listing reported advisories for packages from yiisoft sorted by their report date.

Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
GitHub

yiisoft/yii2

>= 2.0.43, < 2.0.49.4 · >= 2.0.43, < 2.0.50 · = 2.0.49.3

2024-07-08 19:06:03
Unsafe Reflection in base Component class in yiisoft/yii2
GitHub

yiisoft/yii2

< 2.0.49.4 · <= 2.0.49 · < 2.0.50

2024-07-08 19:05:07
Yii SQL injection vulnerability
GitHub

yiisoft/yii2-dev

>= 2.0.13, < 2.0.13.2 · >= 2.0.14, < 2.0.15 · < 2.0.12.1

2024-04-24 18:41:56
Yii Cross-site Scripting Framework vulnerability
GitHub

yiisoft/yii2-dev

= 2.0.12

2024-04-24 18:32:52
Yii Framework Cross-Site Request Forgery (CSRF)
GitHub

yiisoft/yii2

>= 2.0, < 2.0.14

2024-04-24 18:32:30
yii2-redis Potential Remote code execution
GitHub

yiisoft/yii2-redis

< 2.0.8

2024-04-24 18:32:02
Yii PHP Framework arbitrary PHP scripts execution
GitHub

yiisoft/yii

>= 1.1.14, < 1.1.15

2024-04-24 18:31:48
Yii Framework reflected Cross-site Scripting
GitHub

yiisoft/yii2

>= 2.0.0, < 2.0.14

2024-04-24 18:31:31
Yii Framework Code Injection
GitHub

yiisoft/yii2-dev

>= 2.0.0, < 2.0.15 · >= 2.0, < 2.0.15 · < 2.0.5

2024-02-05 15:35:51
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
GitHub

yiisoft/yii2-authclient

<= 2.2.14

2023-12-18 20:01:00
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable
GitHub

yiisoft/yii2-authclient

< 2.2.15

2023-12-18 19:34:25
yiisoft/yii deserializing untrusted user input can lead to remote code execution
GitHub

yiisoft/yii

< 1.1.29

2023-11-14 22:19:30
Yii Framework Reflected XSS
GitHub

yiisoft/yii2

< 2.0.11

2023-10-31 19:48:30
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
GitHub

yiisoft/yii2

>= 2.0.0, < 2.0.5

2023-09-21 16:55:34
Yii Incorrectly Implements CORS
GitHub

yiisoft/yii2

< 2.0.16

2023-08-28 23:18:11
Yii Framework Cross-site Scripting Vulnerability
GitHub

yiisoft/yii2

< 2.0.4

2023-08-03 21:58:51
Command injection in yiisoft/yii2-gii
GitHub

yiisoft/yii2-gii

< 2.2.2

2023-01-31 01:41:32
Yii2 Gii Cross-site Scripting vulnerability
GitHub

yiisoft/yii2-gii

<= 2.2.4

2022-12-21 05:04:56
Prevent RCE when deserializing untrusted user input
GitHub

yiisoft/yii

< 1.1.27

2022-11-21 22:32:05
Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev
GitHub

yiisoft/yii2-dev

< 2.0.43

2021-08-30 20:28:43
Use of Insufficiently Random Values in yiisoft/yii2-dev
GitHub

yiisoft/yii2-dev

< 2.0.43

2021-08-30 20:28:41
Unsafe deserialization in Yii 2
GitHub

yiisoft/yii2

< 2.0.38

2020-09-15 18:19:46
Possible remote code execution via unserialize() on user input containing specially crafted string
FriendsOfPHP

yiisoft/yii2

<2.0.38

2020-09-14 21:15:51
Potential remote code execution in LUA context of the redis server via methods `yii\redis\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-redis

<2.0.8

2018-03-20 14:00:00
Possibility of manipulated condition when unfiltered input is passed to `yii\elasticsearch\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-elasticsearch

<2.0.5

2018-03-20 14:00:00
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2

>=2.0.13, <2.0.13.2 · >=2.0.14, <2.0.15 · <2.0.12.1

2018-03-20 12:28:46
Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`
FriendsOfPHP

yiisoft/yii2-dev

>=2.0.13, <2.0.13.2 · >=2.0.14, <2.0.15 · <2.0.12.1

2018-03-20 12:28:46
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
FriendsOfPHP

yiisoft/yii2-dev

<2.0.14

2018-01-22 08:41:00
Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.
FriendsOfPHP

yiisoft/yii2

<2.0.14

2018-01-22 08:41:00
The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity
FriendsOfPHP

yiisoft/yii2

<2.0.14

2018-01-13 23:13:00
The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity
FriendsOfPHP

yiisoft/yii2-dev

<2.0.14

2018-01-13 23:13:00
class yii\web\ViewAction allowed to include arbitrary files that end with .php
FriendsOfPHP

yiisoft/yii2

<2.0.5

2015-07-10 18:12:53
class yii\web\ViewAction allowed to include arbitrary files that end with .php
FriendsOfPHP

yiisoft/yii2-dev

<2.0.5

2015-07-10 18:12:53
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
FriendsOfPHP

yiisoft/yii2-jui

<2.0.4

2015-05-10 03:58:01
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
FriendsOfPHP

yiisoft/yii2-bootstrap

<2.0.4

2015-05-10 03:43:16
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
FriendsOfPHP

yiisoft/yii2-gii

<2.0.4

2015-05-10 03:41:39
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
FriendsOfPHP

yiisoft/yii2

<2.0.4

2015-05-10 03:38:17
JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks
FriendsOfPHP

yiisoft/yii2-dev

<2.0.4

2015-05-10 03:38:17
The CDetailView widget allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property
FriendsOfPHP

yiisoft/yii

>=1.1.14, <1.1.15

2014-06-30 07:15:00