Skip to content
OpenAdvisories

Package · Packagist

symfony/http-kernel

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2022-24894 Public exploit

    Symfony storing cookie headers in HttpCache

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • Medium 6.5
    CVE-2021-41267

    Webcache Poisoning in Symfony

    Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache pois…

    symfony symfony symfony/symfony symfony/http-kernel Packagist
  • Medium —
    CVE-2015-2308

    Symfony Vulnerable to PHP Eval Injection

    Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.

    symfony/symfony symfony symfony/http-kernel Debian Packagist
  • Medium —
    CVE-2015-4050

    Symfony Incorrect Access Control

    FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attack…

    symfony/symfony symfony symfony/http-kernel Debian Packagist