Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

packagist symfony/symfony Security Advisories

Browse all Security Advisories for packagist symfony/symfony

High

GSA_kwCzR0hTQS1xcTVjLTY3N3AtNzM3cc4ABBBg

Symfony vulnerable to command execution hijack on Windows with Process class
Ecosystems: packagist
Packages: symfony/symfony, symfony/process
Source: GitHub Advisory Database
Blast Radius: 48.2
Published: 15 days ago

Low

GSA_kwCzR0hTQS1nM3JoLXJyaHAtamhoOc4ABBBe

Symfony has an incorrect response from Validator when input ends with `\n`
Ecosystems: packagist
Packages: symfony/validator, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 14.8
Published: 15 days ago

Low

GSA_kwCzR0hTQS05YzN4LXIzd3AtbWd4bc4ABBBd

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-client
Source: GitHub Advisory Database
Blast Radius: 14.1
Published: 15 days ago

Low

GSA_kwCzR0hTQS1qeGdyLTN2N3EtM3c5ds4ABBBc

Symfony's `Security::login` does not take into account custom `user_checker`
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-bundle
Source: GitHub Advisory Database
Blast Radius: 14.2
Published: 15 days ago

Moderate

GSA_kwCzR0hTQS14OHZwLWdmNHEtbXc1as4ABBBb

Symfony allows changing the environment through a query
Ecosystems: packagist
Packages: symfony/symfony, symfony/runtime
Source: GitHub Advisory Database
Blast Radius: 31.8
Published: 15 days ago

High

GSA_kwCzR0hTQS12MzVnLTRycnctaDRmd84AA8jj

Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
Ecosystems: packagist
Packages: symfony/web-profiler-bundle, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 37.0
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS1oeDUzLWpjaHgtY3I1Ms4AA8ji

Symfony2 improper IP based access control
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 25.7
Published: 6 months ago

High

GSA_kwCzR0hTQS1xMmdjLWdnM3gtNzk0Ms4AA8jh

Symfony XML Entity Expansion security vulnerability
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 32.7
Published: 6 months ago

Critical

GSA_kwCzR0hTQS1tbWN2LWZ2cTgtcjl4M84AA8jg

Symfony XML decoding attack vector through external entities
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 42.7
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS03bXgyLTdxOHAtcGdtd84AA8jf

Symfony may allow a user to switch to using another user's identity
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 28.3
Published: 6 months ago

High

GSA_kwCzR0hTQS13dmp2LXA1cnItbW1xbc4AA8jc

Symfony allows direct access of ESI URLs behind a trusted proxy
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-kernel
Source: GitHub Advisory Database
Blast Radius: 43.0
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS1wNjg0LWY3ZmgtanYyas4AA8jb

Symfony has unsafe methods in the Request class
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 30.4
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS1oN3YyLTJxd2ctaDgyOc4AA8ja

Symfony has a security issue when parsing the Authorization header
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 30.4
Published: 6 months ago

High

GSA_kwCzR0hTQS12Nzd2LXg2MzQtOW01Ns4AA8jZ

Symfony vulnerable to denial of service via a malicious HTTP Host header
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 43.0
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS12Zm02LXIyZ2MtcHd3d84AA8jY

Symfony2 security issue when the trust proxy mode is enabled
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 6 months ago

High

GSA_kwCzR0hTQS13ZnY3LTV4MzMtdjIyaM4AA8jX

Code injection in the way Symfony implements translation caching in FrameworkBundle
Ecosystems: packagist
Packages: symfony/symfony, symfony/framework-bundle
Source: GitHub Advisory Database
Blast Radius: 35.9
Published: 6 months ago

Moderate

GSA_kwCzR0hTQS03MngyLTVjODUtNndtcs4AA3Cz

Symfony potential Cross-site Scripting in WebhookController
Ecosystems: packagist
Packages: symfony/symfony, symfony/webhook
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: about 1 year ago

Moderate

GSA_kwCzR0hTQS1xODQ3LTJxNTctd21yM84AA3Cy

Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
Ecosystems: packagist
Packages: symfony/symfony, symfony/twig-bridge
Source: GitHub Advisory Database
Blast Radius: 28.6
Published: about 1 year ago

Moderate

GSA_kwCzR0hTQS1tMndqLXI2ZzMtZnhmeM4AA3Cx

Symfony possible session fixation vulnerability
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-http
Source: GitHub Advisory Database
Blast Radius: 28.5
Published: about 1 year ago

Moderate

GSA_kwCzR0hTQS1oN3ZmLTV3cnYtOWZods4AAxVO

Symfony storing cookie headers in HttpCache
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-kernel
Source: GitHub Advisory Database
Blast Radius: 33.8
Published: almost 2 years ago

Moderate

GSA_kwCzR0hTQS0zZ3YyLTI5cWMtdjY3bc4AAxVN

Symfony vulnerable to Session Fixation of CSRF tokens
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-bundle
Source: GitHub Advisory Database
Blast Radius: 28.9
Published: almost 2 years ago

Critical

GSA_kwCzR0hTQS1xODd2LXE4ZnctZ21qNc4AAgyh

Symfony Incorrect Access Control
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-core
Source: GitHub Advisory Database
Blast Radius: 45.6
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS04OWNwLWZ2Y2MtaHhoN84AAfYj

Symfony Access Control Vulnerability
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS04M2MzLXF4MjctMnJ3cs4AAfXs

Symfony Allows URI Restrictions Bypass Via Double-Encoded String
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/routing, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS1jcjQ5LWZ4MnYtOXA1N84AAd7g

Symfony Denial of Service Via Long Password Hashing
Ecosystems: packagist
Packages: symfony/security, symfony/polyfill, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

High

GSA_kwCzR0hTQS1qang1LWZxNWctOHhwY84AAdU8

Symfony Cryptographic Vulnerability
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-core
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 2 years ago

High

GSA_kwCzR0hTQS13aGd2LThjZzMtN2hjbc4AAdU9

Symphony Denial of Service Via Overlong Usernames
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-http
Source: GitHub Advisory Database
Blast Radius: 32.9
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS01YzU4LXc5eGMtcWNqOc4AAc0N

Symfony Vulnerable to PHP Eval Injection
Ecosystems: packagist
Packages: symfony/http-kernel, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

High

GSA_kwCzR0hTQS1nOTdjLWpmeDYteHZ4aM4AAcl9

Symfony Vulnerable to Timing Attack
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-http, symfony/form
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS1xbXF3LW1wcXAtbXI1NM4AAcRE

Symfony Incorrect Access Control
Ecosystems: packagist
Packages: symfony/http-kernel, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

High

GSA_kwCzR0hTQS0ycjVoLTZyN3YtNW03Y84AAZ6g

Symphony Vulnerable to PHP Code Injection via YAML Parsing
Ecosystems: packagist
Packages: symfony/yaml, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

High

GSA_kwCzR0hTQS03dzUzLWhmcHctcmczZ84AAZ60

Symfony Arbitrary PHP code Execution
Ecosystems: packagist
Packages: symfony/yaml, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 2 years ago

Critical

GSA_kwCzR0hTQS0zNWM1LTI4cGctMnFnNM4AAWke

Symfony Authentication Bypass
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-core
Source: GitHub Advisory Database
Blast Radius: 45.6
Published: over 2 years ago

Critical

GSA_kwCzR0hTQS13dmo1LXI3OHItaGhmcc4AAWjw

Symfony Authentication Bypass
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-core
Source: GitHub Advisory Database
Blast Radius: 45.6
Published: over 2 years ago

Low

GSA_kwCzR0hTQS1qNWpoLWhwcjQtaDMzMs4AAV_7

Symfony Session Fixation Vulnerability
Ecosystems: packagist
Packages: symfony/security, symfony/security-http, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 13.6
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS1jcXFoLTk0cjYtd2pyZ84AAV2m

Symfony SSRF Vulnerability via Form Component
Ecosystems: packagist
Packages: symfony/symfony, symfony/form
Source: GitHub Advisory Database
Blast Radius: 30.1
Published: over 2 years ago

High

GSA_kwCzR0hTQS02NnA2LTdwMjktNTVwOc4AAVWh

Symfony Host Header Injection
Ecosystems: packagist
Packages: symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago

High

GSA_kwCzR0hTQS1nNHJnLXJ3NjUtOGhmZ84AAT6-

Moderate

GSA_kwCzR0hTQS1yN3A3LXFyN3AtMnJyZs4AAT52

Symfony Open Redirect
Ecosystems: packagist
Packages: symfony/security, symfony/security-http, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 26.8
Published: over 2 years ago

High

GSA_kwCzR0hTQS1jNDlyLThnajYtNzY4cs4AAT5H

Symfony Directory Traversal
Ecosystems: packagist
Packages: symfony/symfony, symfony/intl
Source: GitHub Advisory Database
Blast Radius: 33.7
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS03aHdjLTJjcTQtNngyd84AAT5V

Symfony Open Redirect
Ecosystems: packagist
Packages: symfony/security-bundle, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 28.0
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS1yMnJxLTNoNTYtZnFtNM4AATu7

Symfony DoS
Ecosystems: packagist
Packages: symfony/http-foundation, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 33.8
Published: over 2 years ago

High

GSA_kwCzR0hTQS1nNGc3LXE3MjYtdjVoZ84AATux

Symfony CSRF Token Fixation
Ecosystems: packagist
Packages: symfony/security, symfony/security-http, symfony/security-bundle, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 40.4
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS04OXIyLTVnMzQtMmc0N84AATfR

Symfony Open Redirect
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-http
Source: GitHub Advisory Database
Blast Radius: 26.8
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS14M2NmLXc2NHgtNGNwMs4AATfM

Symfony Path Disclosure
Ecosystems: packagist
Packages: symfony/form, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS05Mng2LWgyZ3ItOGd4cc4AASJF

Symfony CSRF Vulnerability
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-csrf
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS04d2dqLTZ3eDgtaDVocc3r4Q

Symfony HTTP Foundation web cache poisoning
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-foundation
Source: GitHub Advisory Database
Blast Radius: 37.2
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS0yMnB2LTd2OWotaHF4cM3grg

Symfony Host Header Injection vulnerability in the HttpFoundation component
Ecosystems: packagist
Packages: symfony/http-foundation, symfony/symfony
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 2 years ago

High

GSA_kwCzR0hTQS1xOGo3LWZqaDctMjV2Nc3gFg

Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Ecosystems: packagist
Packages: symfony/symfony, symfony/validator
Source: GitHub Advisory Database
Blast Radius: 38.8
Published: over 2 years ago

High

GSA_kwCzR0hTQS1xOGhnLXBmOHYtY3hyds02BA

Symfony Http-Kernel has non-constant time comparison in UriSigner
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-kernel
Source: GitHub Advisory Database
Blast Radius: 46.4
Published: over 2 years ago

Moderate

GSA_kwCzR0hTQS0yeGhnLXcyZzUtdzk1eM0YGA

CSV Injection in symfony/serializer
Ecosystems: packagist
Packages: symfony/symfony, symfony/serializer
Source: GitHub Advisory Database
Blast Radius: 30.5
Published: almost 3 years ago

Moderate

GSA_kwCzR0hTQS1xdzM2LXA5N3ctdmNxcs0YFw

Cookie persistence after password changes in symfony/security-bundle
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-bundle
Source: GitHub Advisory Database
Blast Radius: 29.8
Published: almost 3 years ago

Moderate

GSA_kwCzR0hTQS1xM2ozLXczN3gtaHEycc0YFQ

Webcache Poisoning in symfony/http-kernel
Ecosystems: packagist
Packages: symfony/symfony, symfony/http-kernel
Source: GitHub Advisory Database
Blast Radius: 37.2
Published: almost 3 years ago

Moderate

MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmY2YtbTY3bS1qY3Jx

Authentication granted to all firewalls instead of just one
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-http
Source: GitHub Advisory Database
Blast Radius: 29.9
Published: over 3 years ago

Low

MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWcycWotcG14bS05Zjhm

User enumeration in authentication mechanisms
Ecosystems: packagist
Packages: symfony/symfony, symfony/security-http
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 3 years ago

Moderate

MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVwdjgtcHB2ai00aDY4

Prevent user enumeration using Guard or the new Authenticator-based Security
Ecosystems: packagist
Packages: symfony/symfony, symfony/security, symfony/security-http, symfony/maker-bundle, lexik/jwt-authentication-bundle, symfony/security-core, symfony/security-guard
Source: GitHub Advisory Database
Blast Radius: 24.7
Published: over 3 years ago

High

Advisories: 20,668
Packages: 9,040
Repositories: 3
Ecosystems: 12

Filter by Severity

Moderate 8,836 High 7,269 Critical 3,070 Low 1,144

Filter by Ecosystem

maven 5,864 packagist 4,634 pypi 4,352 npm 3,812 go 2,295 nuget 1,552 cargo 882 rubygems 880 swift 33 hex 32 actions 20 pub 9

Filter by Package

moodle/moodle 367 magento/community-edition 235 typo3/cms 174 pimcore/pimcore 118 dolibarr/dolibarr 113 typo3/cms-core 106 microweber/microweber 94 drupal/core 92 phpmyadmin/phpmyadmin 92 silverstripe/framework 85 drupal/drupal 78 librenms/librenms 74 thorsten/phpmyfaq 70 symfony/symfony 69 concrete5/concrete5 60 shopware/platform 52 baserproject/basercms 47 craftcms/cms 46 showdoc/showdoc 40 shopware/core 40 intelliants/subrion 39 froxlor/froxlor 38 nilsteampassnet/teampass 37 mautic/core 37 snipe/snipe-it 35 zendframework/zendframework1 34 shopware/shopware 30 getgrav/grav 29 mediawiki/core 28 centreon/centreon 27 prestashop/prestashop 26 magento/core 24 contao/core-bundle 24 zendframework/zendframework 23 pocketmine/pocketmine-mp 23 remdex/livehelperchat 23 simplesamlphp/simplesamlphp 23 grumpydictator/firefly-iii 23 getkirby/cms 22 tribalsystems/zenario 22 funadmin/funadmin 20 laravel/framework 20 contao/contao 19 topthink/framework 18 cockpit-hq/cockpit 18 forkcms/forkcms 18 symfony/security 17 francoisjacquet/rosariosis 17 ezsystems/ezpublish-kernel 17 cakephp/cakephp 17 opencart/opencart 17 genix/cms 17 openmage/magento-lts 16 phpbb/phpbb 16 typo3/cms-backend 16 yetiforce/yetiforce-crm 16 smarty/smarty 15 symfony/security-http 15 ec-cube/ec-cube 15 october/system 15 dompdf/dompdf 14 phpmailer/phpmailer 14 silverstripe/cms 14 feehi/cms 14 bolt/bolt 14 admidio/admidio 13 sylius/sylius 13 codeigniter4/framework 13 impresscms/impresscms 13 lavalite/cms 13 pimcore/admin-ui-classic-bundle 13 studio-42/elfinder 13 elefant/cms 13 phpmyfaq/phpmyfaq 12 phpoffice/phpspreadsheet 12 symfony/http-foundation 12 wwbn/avideo 12 wallabag/wallabag 11 pagekit/pagekit 11 nukeviet/nukeviet 11 tinymce/tinymce 11 TinyMCE 11 tinymce 11 feehi/feehicms 11 ezsystems/ezplatform-kernel 11 october/october 10 ssddanbrown/bookstack 10 ezsystems/ezpublish-legacy 10 sulu/sulu 10 yiisoft/yii2 10 org.webjars:bootstrap 9 concrete5/core 9 kevinpapst/kimai2 9 bootstrap 9 bootstrap 9 bootstrap 9 twbs/bootstrap 9 statamic/cms 9 contao/core 9 alextselegidis/easyappointments 9 mantisbt/mantisbt 8 composer/composer 8 facturascripts/facturascripts 8 pimcore/customer-management-framework-bundle 8 twig/twig 8 pterodactyl/panel 8 croogo/croogo 8 gilacms/gila 8 silverstripe/graphql 8 ezsystems/ezplatform-admin-ui 8 silverstripe/admin 8 october/cms 8 codiad/codiad 8 billz/raspap-webgui 7 flarum/core 7 symfony/http-kernel 7 passbolt/passbolt_api 7 backdrop/backdrop 7 bootstrap-sass 7 bootstrap.sass 7 october/backend 7 wpglobus/wpglobus 7 gleez/cms 6 pear/archive_tar 6 bagisto/bagisto 6 in2code/femanager 6 directmailteam/direct-mail 6 zoujingli/thinkadmin 6 phpseclib/phpseclib 6 yiisoft/yii2-dev 6 icecoder/icecoder 6 guzzlehttp/guzzle 6 oro/platform 6 dweeves/magmi 6 vrana/adminer 6 yourls/yourls 6 nystudio107/craft-seomatic 6 neos/flow 5 cachethq/cachet 5 codeigniter/framework 5 bottelet/flarepoint 5 phpservermon/phpservermon 5 typo3/cms-install 5 elgg/elgg 5 typo3/flow 5 simplesamlphp/saml2 5 bootstrap-sass 5 gugoan/economizzer 5 phpxmlrpc/phpxmlrpc 5 ibexa/core 5 silverstripe/assets 5 kimai/kimai 5 thinkcmf/thinkcmf 5 limesurvey/limesurvey 5 symfony/security-core 5 woocommerce/woocommerce 5 neos/neos 5 anchorcms/anchor-cms 5 mautic/core-lib 5 symfony/security-bundle 5 illuminate/database 5 automad/automad 4 ezsystems/ezplatform 4 processwire/processwire 4 idno/known 4 modx/revolution 4 wintercms/winter 4 ezyang/htmlpurifier 4 oro/commerce 4 typo3/html-sanitizer 4 codeigniter4/shield 4 bref/bref 4 spatie/browsershot 4 typo3/cms-frontend 4 friendsofsymfony/user-bundle 4 magento/product-community-edition 4 sylius/resource-bundle 4 zendframework/zendopenid 4 pyrocms/pyrocms 4 notrinos/notrinos-erp 4 evolutioncms/evolution 4 wp-premium/gravityforms 4 bytefury/crater 4 shopware/storefront 4 adodb/adodb-php 4 appwrite/server-ce 4 reportico-web/reportico 4 shopxo/shopxo 4 zendframework/zendservice-nirvanix 3 tecnickcom/tcpdf 3 zendframework/zend-diactoros 3 swiftmailer/swiftmailer 3 getformwork/formwork 3 zendframework/zendservice-audioscrobbler 3 artesaos/seotools 3 buddypress/buddypress 3 zendframework/zendrest 3 qcubed/qcubed 3 django-tinymce 3 yiisoft/yii 3

Filter by Repository

https://github.com/symfony/symfony 61 https://github.com/symfony/http-foundation 1