CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 1CVE-2019-10910
https://notcve.org/view.php?id=CVE-2019-10910
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection. En Symfony antes de 2.7.51, 2.8.x antes de 2.8.50, 3.x antes de 3.4.26, 4.x antes de 4.1.12 y 4.2.x antes de 4.2.7, cuando los identificadores de servicio permiten la entrada del usuario, esto podría permitir una inyección SQL y ejecución remota de código. Esto está relacionado con Symfony / dependency-inyection. • https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid https://www.synology.com/security/advisory/Synology_SA_19_19 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2019-10909
https://notcve.org/view.php?id=CVE-2019-10909
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. En Symfony anterior de la versión 2.7.51, versión 2.8.x anterior de 2.8.50, versión 3.x anterior de 3.4.26, versión 4.x anterior de 4.1.12 y versión 4.2.x anterior de 4.2.7, los mensajes de validación no son evadidos, lo que puede llevar a una vulnerabilidad de XSS cuando una entrada del usuario sea incluida. Esto está relacionado con symfony/framework-bundle • https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2 https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine https://www.drupal.org/sa-core-2019-005 https://www.synology.com/security/advisory/Synology_SA_19_19 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-19790
https://notcve.org/view.php?id=CVE-2018-19790
An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login. Se ha descubierto una redirección abierta en Symfony en versiones 2.7.x anteriores a la 2.7.50, versiones 2.8.x anteriores a la 2.8.49, versiones 3.x anteriores a la 3.4.20, versiones 4.0.x anteriores a la 4.0.15, versiones 4.1.x anteriores a la 4.1.9 y versiones 4.2.x anteriores a la 4.2.1. Mediante el uso de barras invertidas en el campo de entrada "_failure_path" de los formularios de inicio de sesión, un atacante puede sortear las restricciones de destino de redirección y redirigir de forma efectiva al usuario a cualquier dominio una vez ha iniciado sesión. • http://www.securityfocus.com/bid/106249 https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ https://seclists.org/bugtraq/2019/May/21 https://sym • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 1%CPEs: 7EXPL: 0CVE-2018-19789
https://notcve.org/view.php?id=CVE-2018-19789
An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution. Se ha descubierto un problema en Symfony en versiones 2.7.x anteriores a la 2.7.50, versiones 2.8.x anteriores a la 2.8.49, versiones 3.x anteriores a la 3.4.20, versiones 4.0.x anteriores a la 4.0.15, versiones 4.1.x anteriores a la 4.1.9 y versiones 4.2.x anteriores a la 4.2.1. • http://www.securityfocus.com/bid/106249 https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA4WVFN5FYPIXAPLWZI6N425JHHDSWAZ https://seclists.org/bugtraq/2019/May/21 https://sym • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2017-16653
https://notcve.org/view.php?id=CVE-2017-16653
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks. Se ha descubierto un problema en Symfony en versiones anteriores a la 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5 y 4.0-BETA5. La implementación actual de la protección CSRF en Symfony (versiones a partir de la 2) no emplea tokens diferentes para HTTP y HTTPS; por lo tanto, el token es vulnerable a ataques Man-in-the-Middle (MitM) en HTTP y puede emplearse en un contexto HTTPS para realizar ataques Cross-Site Request Forgery (CSRF). • https://github.com/symfony/symfony/pull/24992 https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https https://www.debian.org/security/2018/dsa-4262 •