** DISPUTED ** The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar.

** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues)."

Prevent cache poisoning via a Response Content-Type header in Symfony

Exceptions displayed in non-debug configurations in Symfony

Symfony possible session fixation vulnerability

Symfony Cryptographic Vulnerability

Symfony Session Fixation Vulnerability

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.

Symfony storing cookie headers in HttpCache

Symfony Vulnerable to Timing Attack

Symfony Session Fixation Vulnerability

Firewall configured with unanimous strategy was not actually unanimous in Symfony

Symfony CSRF Token Fixation

Symfony Denial of Service Via Long Password Hashing

Symfony SSRF Vulnerability via Form Component

Symfony Directory Traversal

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."

Symfony CSRF Vulnerability

Symfony Open Redirect

Symfony Access Control Vulnerability