Skip to content
OpenAdvisories

Package · Packagist

symfony/dependency-injection

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    GHSA-c636-cg5r-2498

    Symfony XML Entity Expansion security vulnerability

    Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion (XEE) attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerabil…

    symfony/dependency-injection Packagist
  • Critical 9.8
    CVE-2019-10910

    Symfony Service IDs Allow Injection

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

    symfony/symfony symfony symfony symfony/dependency-injection Debian Ubuntu Packagist