7 results (0.002 seconds)

CVSS: 7.5EPSS: %CPEs: 3EXPL: 0

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8. • https://github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135a https://github.com/symfony/symfony/security/advisories/GHSA-cg23-qf8f-62rr • CWE-287: Improper Authentication CWE-289: Authentication Bypass by Alternate Name •

CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 1

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Nyamort/CVE-2024-50340 https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 0

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/symfony/symfony/commit/22a0789a0085c3ee96f4ef715ecad8255cf0e105 https://github.com/symfony/symfony/security/advisories/GHSA-jxgr-3v7q-3w9v • CWE-287: Improper Authentication •

CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 0

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 0

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f https://github.com/symfony/symfony/security/advisories/GHSA-g3rh-rrhp-jhh9 • CWE-20: Improper Input Validation •