Symfony — фреймворк c открытым исходным кодом, написанный на PHP.
Релизный цикл, информация об уязвимостях
График релизов
Количество 378
GHSA-c49r-8gj6-768r
Symfony Directory Traversal
GHSA-r2rq-3h56-fqm4
Symfony DoS
GHSA-j5jh-hpr4-h332
Symfony Session Fixation Vulnerability
GHSA-r7p7-qr7p-2rrf
Symfony Open Redirect
GHSA-x3cf-w64x-4cp2
Symfony Path Disclosure
GHSA-wvj5-r78r-hhfq
Symfony Authentication Bypass
GHSA-mm4c-ww47-3x4c
** DISPUTED ** The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar.
GHSA-mjcw-3g32-5p52
** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues)."
GHSA-92x6-h2gr-8gxq
Symfony CSRF Vulnerability
GHSA-8wgj-6wx8-h5hq
Symfony HTTP Foundation web cache poisoning
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-c49r-8gj6-768r Symfony Directory Traversal | CVSS3: 7.5 | 3% Низкий | больше 4 лет назад |
| GHSA-r2rq-3h56-fqm4 Symfony DoS | CVSS3: 5.9 | 2% Низкий | больше 4 лет назад |
| GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability | CVSS3: 3.1 | 3% Низкий | больше 4 лет назад |
| GHSA-r7p7-qr7p-2rrf Symfony Open Redirect | CVSS3: 6.1 | 1% Низкий | больше 4 лет назад |
| GHSA-x3cf-w64x-4cp2 Symfony Path Disclosure | CVSS3: 5.3 | 4% Низкий | больше 4 лет назад |
| GHSA-wvj5-r78r-hhfq Symfony Authentication Bypass | CVSS3: 9.8 | 4% Низкий | больше 4 лет назад |
| GHSA-mm4c-ww47-3x4c ** DISPUTED ** The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar. | CVSS3: 6.1 | 6% Низкий | больше 4 лет назад |
| GHSA-mjcw-3g32-5p52 ** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues)." | CVSS3: 6.1 | 1% Низкий | больше 4 лет назад |
| GHSA-92x6-h2gr-8gxq Symfony CSRF Vulnerability | CVSS3: 5.9 | 1% Низкий | больше 4 лет назад |
| GHSA-8wgj-6wx8-h5hq Symfony HTTP Foundation web cache poisoning | CVSS3: 6.5 | 58% Средний | больше 4 лет назад |
Уязвимостей на страницу