Most severe vulnerabilities for "sensiolabs symfony" 5.0.0

Where

AND

Sort:

composer/symfony/symfonyPossible CSRF token fixation

Risk 77

Severity

8.8

CSRF

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2022-24895: Possible CSRF token fixation

1 / 3

First published (updated )

CVE-2022-24895

composer/symfony/symfonyPrevent storing cookie headers in HttpCache

Risk 85

Severity

8.8

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2022-24894: Prevent storing cookie headers in HttpCache

1 / 3

First published (updated )

CVE-2022-24894

composer/symfony/security-httpAll rules set in "access_control" are required when the firewall is configured with the unanimous strategy

Risk 62

Severity

8.1

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

CVE-2020-5275: All rules set in "accesscontrol" are required when the firewall is configured with the unanimous strategy

1 / 3

First published (updated )

CVE-2020-5275

composer/symfony/symfonyPrevent CSV Injection via formulas

Risk 40

Severity

6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE-2021-41270: Prevent CSV Injection via formulas

1 / 3

First published (updated )

CVE-2021-41270

composer/symfony/symfonyPotential XSS vulnerabilities in CodeExtension filters

Risk 39

Severity

6.1

XSS

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Some Twig filters in CodeExtension use "issafe=html" but don't actually ensure their input is safe.

Resolution

Symfony now escapes the output of the affected filters.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Pierre Rudloff for reporting the issue and to Nicolas Grekas for providing the fix.

1 / 4

First published (updated )

CVE-2023-46734

composer/symfony/symfonyFix Exception message escaping rendered by ErrorHandler

Risk 36

Severity

5.4

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler

1 / 3

First published (updated )

CVE-2020-5274

composer/symfony/symfonyPrevent user enumeration via response content in authentication mechanisms

Risk 30

Severity

5.3

Infoleak

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms

1 / 3

First published (updated )

CVE-2021-21424

composer/symfony/http-foundationPrevent cache poisoning via a Response Content-Type header

Risk 23

Severity

4.3

Input Validation

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header

1 / 3

First published (updated )

CVE-2020-5255

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending

Company

Resources

Contact