Skip to content
OpenAdvisories

Package · Packagist

symfony/symfony

102 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

44 results · Clear filters · Feed

  • Medium —
    CVE-2015-4050 Scanner template

    Symfony Incorrect Access Control

    FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attack…

    symfony/symfony symfony symfony/http-kernel Debian Packagist
  • Medium —
    CVE-2013-5958

    Symfony Denial of Service Via Long Password Hashing

    The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as d…

    symfony/symfony symfony/security symfony/polyfill Packagist
  • Medium —
    CVE-2012-6431

    Symfony Allows URI Restrictions Bypass Via Double-Encoded String

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/symfony symfony/security symfony/http-foundation symfony/routing Packagist
  • Medium —
    CVE-2012-6432

    Symfony Access Control Vulnerability

    Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.

    symfony/symfony Packagist