symfony/security-http Security Advisories - Packagist

packagist symfony/symfony, symfony/security, symfony/security-http, symfony/maker-bundle, lexik/jwt-authentication-bundle, symfony/security-core, symfony/security-guard

High

over 6 years ago

Firewall configured with unanimous strategy was not actually unanimous in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc0bTktNWhwZi1oeDcy

packagist symfony/security-http, symfony/security

High

over 6 years ago

Improper authentication in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNjaHgtbWZyYy1md3Fy

packagist symfony/symfony, symfony/security, symfony/security-http

Moderate

over 6 years ago

User enumeration leak using switch user functionality in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR2cGMtNWp4NC1jZnFn

packagist symfony/symfony, symfony/security-http

Filter by Severity

High 8 Moderate 7 Low 1

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories

symfony/security-http

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes GSA_kwCzR0hTQS02aDQ2LTlqZjUtcTU5eM4ABYra

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] GSA_kwCzR0hTQS02NDM5LTJmMjgtOHA4cc4ABXk9

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay GSA_kwCzR0hTQS1qOGdqLTlybTUtNHhoeM4ABXk8

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims GSA_kwCzR0hTQS0yOWZjLXA2YzQtMjRjZ84ABXk3

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator GSA_kwCzR0hTQS1waDg2LXA4ZjYtZjlyMs4ABXkX

Symfony has an Authentication Bypass via RememberMe GSA_kwCzR0hTQS1jZzIzLXFmOGYtNjJycs4ABBTJ

Symfony possible session fixation vulnerability GSA_kwCzR0hTQS1tMndqLXI2ZzMtZnhmeM4AA3Cx

Symphony Denial of Service Via Overlong Usernames GSA_kwCzR0hTQS13aGd2LThjZzMtN2hjbc4AAdU9

Symfony Vulnerable to Timing Attack GSA_kwCzR0hTQS1nOTdjLWpmeDYteHZ4aM4AAcl9

Symfony Open Redirect GSA_kwCzR0hTQS04OXIyLTVnMzQtMmc0N84AATfR

Authentication granted to all firewalls instead of just one MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmY2YtbTY3bS1qY3Jx

User enumeration in authentication mechanisms MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWcycWotcG14bS05Zjhm

Prevent user enumeration using Guard or the new Authenticator-based Security MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVwdjgtcHB2ai00aDY4

Firewall configured with unanimous strategy was not actually unanimous in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc0bTktNWhwZi1oeDcy

Improper authentication in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNjaHgtbWZyYy1md3Fy

User enumeration leak using switch user functionality in Symfony MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR2cGMtNWp4NC1jZnFn

Filter by Severity