22 matches found
EUVD-2022-3415
Malicious code in bioql PyPI...
CVE-2013-5750
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
Weak Entropy In Token Generation
friendsofsymfony/user-bundle is vulnerable to Weak Entropy in Token Generation. The vulnerability is due to the imprecise nature of the baseconvert function used in FOSUserBundle, which allows attackers to exploit the weakened randomness of tokens generated for email confirmation and password...
GHSA-8WX3-8M4X-G5H4 FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their...
FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their...
GHSA-6MJQ-9X4W-M3W9 FOSUserBundle Session Hijacking Vulnerability
Versions of FOSUserBundle from 1.2.x to 1.2.4 have been found to contain a security vulnerability related to session hijacking. This issue has been addressed in version 1.2.4, and users are strongly advised to upgrade to the latest version to prevent potential session-related security risks...
FOSUserBundle Session Hijacking Vulnerability
Versions of FOSUserBundle from 1.2.x to 1.2.4 have been found to contain a security vulnerability related to session hijacking. This issue has been addressed in version 1.2.4, and users are strongly advised to upgrade to the latest version to prevent potential session-related security risks...
GHSA-PJX8-984P-7P3X FOSUserBundle Entropy is lost in the TokenGenerator
Description Because of the usage of baseconvert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically...
FOSUserBundle Entropy is lost in the TokenGenerator
Description Because of the usage of baseconvert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically...
PT-2024-40131 · Unknown · Fosuserbundle
Name of the Vulnerable Software and Affected Versions: FOSUserBundle versions 1.2.x through 1.2.3 Description: A security issue related to session hijacking has been identified. The estimated number of potentially affected devices is not specified. This issue has been addressed in a newer version...
FriendsOfSymfony FOSUserBundle denial of service via login form
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
GHSA-9MPF-G3FC-9RGV FriendsOfSymfony FOSUserBundle denial of service via login form
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
Denial Of Service (DoS)
FOSUserBundle is vulnerable to denial of service DoS attacks. A malicious user can pass a very long password to the application that will result in an expensive hash computation, causing the application to run out of resources and crash...
Security releases (CVE-2013-5958): Symfony 2.0.25, 2.1.13, 2.2.9, and 2.3.6 released
Log in to add a reaction to this post add a reaction ❤️ 👍 🚀 Symfony 2.0.25, 2.1.13, 2.2.9, and 2.3.6 have just been released; they contain a security fix for the Security component CVE-2013-5958. Note Even if the end of life of Symfony 2.0 was reached last month, we are also releasing a new versio...
CVE-2013-5750
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
Design/Logic Flaw
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
CVE-2013-5750
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...
CVE-2013-5750
The CVE concerns the FriendsOfSymfony FOSUserBundle login form (Symfony) prior to 1.3.3. The vulnerability is a denial of service caused by an expensive hash computation triggered by a very long password (PBKDF2), leading to high CPU usage. The connected records confirm the issue and its scope bu...
PT-2013-5765
Name of the Vulnerable Software and Affected Versions FOSUserBundle versions prior to 1.3.3 Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by submitting a long password to the login form. This triggers an expensive hash computation, such ...
CVE-2013-5750: Undefined Security Weakness
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation...