XSS injection in the Grid component of Sylius

Grid component of Sylius omits HTML input sanitisation while rendering object implementing toString method through the string field type...

Sylius ResourceBundle Information Disclosure Vulnerability

Sylius is a set of Symfony framework based on open source e-commerce platform . An information disclosure vulnerability exists in Sylius ResourceBundle. The vulnerability stems from a configuration or other error in the operation of a network system or product. An unauthorized attacker can exploi...

Sylius Environment Issues Vulnerabilities

Sylius is a set of Symfony framework based on open source e-commerce platform . An environmental issue vulnerability exists in Sylius. The vulnerability stems from an unreasonable environmental factor in a networked system or product. No detailed vulnerability details are provided at this time...

Unauthorized Channel Switching

Sylius is vulnerable to unauthorised channel switching. The vulnerability exists even when kernel.debug is not set to true, the channels can be switched by providing the channelcode GET parameter in production environments...

GHSA-PRG5-HG25-8GRQ Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

Ability to expose data in Sylius by using an unintended serialisation group

Impact ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

GHSA-8VP7-J5CJ-VVM2 Ability to expose data in Sylius by using an unintended serialisation group

Impact ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

Information Disclosure

sylius/resource-bundle is vulnerable to information disclosure. The vulnerability exists as ResourceBundle did not properly restrict the values of serializationgroups to be passed through the HTTP header...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

CVE-2020-5220

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

Design/Logic Flaw

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

Design/Logic Flaw

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

CVE-2020-5218

Summary. CVE-2020-5218 affects Sylius: in production, attackers could switch channels via the _channel_code GET parameter due to an unresolved default of kernel.debug when sylius_channel.debug is not explicitly set. This misconfiguration enables the debug feature even if the parameter is false. R...

CVE-2020-5218 Ability in Sylius to switch channels via GET parameter enabled in production environments

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

CVE-2020-5220

Sylius ResourceBundle has a vulnerability where it accepts and uses any serialization groups via an HTTP header, potentially exposing data by using an unintended serialization group (e.g., a permissive group from Admin API in Shop API). Affected products are Sylius ResourceBundle components, with...

CVE-2020-5220 Ability to expose data in Sylius by using an unintended serialisation group

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's...

Sylius Cross-Site Scripting Vulnerability

Sylius is a set of Symfony framework based on open source e-commerce platform . A cross-site scripting vulnerability exists in Sylius. The vulnerability stems from the lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to execute...