CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-11407
https://notcve.org/view.php?id=CVE-2018-11407
13 Jun 2018 — An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403. Se ha descubierto un problema en el componente Ldap en Symfony en versiones 2.8.x anteriores a la 2.8.37, versiones 3.3.x anteriores a la 3.3.17, ve... • https://symfony.com/blog/cve-2018-11407-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2018-11408
https://notcve.org/view.php?id=CVE-2018-11408
13 Jun 2018 — The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652. Los gestores de seguridad en el componente Security en Symfony en versiones 2.7.x anteriores a la 2.7.48, versiones 2.8.x anteriores a la 2.8.41, versiones 3.3.x anteriores a la 3.3... • https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2018-12040 – SensioLabs Symfony 3.3.6 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-12040
09 Jun 2018 — Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues). ** EN DISPUTA ** Vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el generador de perfiles web en Symfony 3.3.6, de... • https://packetstorm.news/files/id/148125 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2016-2403 – Debian Security Advisory 4262-1
https://notcve.org/view.php?id=CVE-2016-2403
07 Feb 2017 — Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. Symfony en versiones anteriores a 2.8.6 y 3.x en versiones anteriores a 3.0.6 permite a atacantes remotos eludir la autenticación mediante el inicio de sesión con un nombre de usuario válido y una contraseña vacía, lo que desencadena una unión no autenticada. Multiple vulnerabilities have been found in the Symfony PHP fram... • http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2016-1902 – Debian Security Advisory 3588-1
https://notcve.org/view.php?id=CVE-2016-1902
30 May 2016 — The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. La función nextBytes en la clase SecureRandom en Symfony en versiones anteriores a 2.3.37, 2.6.x en versiones anteriores a 2.... • http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 1%CPEs: 27EXPL: 0CVE-2016-4423 – Debian Security Advisory 3588-1
https://notcve.org/view.php?id=CVE-2016-4423
30 May 2016 — The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames. La función attemptAuthentication en Component/Security/Http/Firewall/UsernamePa... • http://www.debian.org/security/2016/dsa-3588 • CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 0%CPEs: 54EXPL: 0CVE-2015-8124 – Debian Security Advisory 3402-1
https://notcve.org/view.php?id=CVE-2015-8124
24 Nov 2015 — Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Vulnerabilidad de fijación de sesión en la funcionalidad de inicio de sesión 'Remember Me' en Symfony 2.3.x en versiones anteriores a 2.3.35, 2.6.x en versiones anteriores a 2.6.12 y 2.7.x en versiones anteriores a 2.7.7 permite a atacantes remotos secuestrar sesiones web a través de un id de sesión. Sev... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html •
CVSS: 7.5EPSS: 0%CPEs: 54EXPL: 0CVE-2015-8125 – Debian Security Advisory 3402-1
https://notcve.org/view.php?id=CVE-2015-8125
24 Nov 2015 — Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form compo... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html •
CVSS: 6.8EPSS: 0%CPEs: 75EXPL: 0CVE-2015-2308
https://notcve.org/view.php?id=CVE-2015-2308
24 Jun 2015 — Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element. Vulnerabilidad de inyección Eval en la clase HttpCache en HttpKernel en Symfony 2.x anterior a 2.3.27, 2.4.x y 2.5.x anterior a 2.5.11, y 2.6.x anterior a 2.6.6 permite a atacantes remotos ejecutar código PHP arbitrario a través de un atributo language='ph... • http://jvn.jp/en/jp/JVN19578958/index.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 73%CPEs: 27EXPL: 0CVE-2015-4050 – Debian Security Advisory 3276-1
https://notcve.org/view.php?id=CVE-2015-4050
01 Jun 2015 — FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. FragmentListener en el componente HttpKernel en Symfony 2.3.19 hasta 2.3.28, 2.4.9 hasta 2.4.10, 2.5.4 hasta 2.5.11, y 2.6.0 hasta 2... • http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html • CWE-284: Improper Access Control •