Symfony — фреймворк c открытым исходным кодом, написанный на PHP.

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Firewall configured with unanimous strategy was not actually unanimous in Symfony

Exceptions displayed in non-debug configurations in Symfony

Prevent cache poisoning via a Response Content-Type header in Symfony

Improper authentication in Symfony

Deserialization of untrusted data in Symfony

Improper Input Validation in Symfony

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.

Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

User enumeration leak using switch user functionality in Symfony