CVE-2017-16652: Open redirect vulnerability on security handlers

Affected versions Symfony 2.7.0 to 2.7.37, 2.8.0 to 2.8.30, 3.2.0 to 3.2.13, and 3.3.0 to 3.3.12 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. Note that no fixes are...

CVE-2017-16790: Ensure that submitted data are uploaded files

Affected versions Symfony 2.7.0 to 2.7.37, 2.8.0 to 2.8.30, 3.2.0 to 3.2.13, and 3.3.0 to 3.3.12 versions of the Symfony Form component are affected by this security issue. The issue has been fixed in Symfony 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. Note that no fixes are provide...

CVE-2017-16654: Intl bundle readers breaking out of paths

More info at https://symfony.com/cve-2017-16654...

CVE-2017-16652: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2017-16652...

CVE-2017-16652: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2017-16652...

CVE-2017-16790: Ensure that submitted data are uploaded files

More info at https://symfony.com/cve-2017-16790...

CVE-2017-16652: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2017-16652...

CVE-2017-16790: Ensure that submitted data are uploaded files

More info at https://symfony.com/cve-2017-16790...

CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS

More info at https://symfony.com/cve-2017-16653...

Shopware 5.3.3: PHP Object Instantiation to Blind XXE

Shopwareis a popular e-commerce software. It is based on PHP using technologies like Symfony 2, Doctrine and the Zend Framework. The code base of its open source community edition encompasses over 690,000 lines of code which we scanned for security vulnerabilities with our RIPS static code...

Password Bypass

symfony is vulnerable to password bypass. The library will take an empty password as valid, allowing attackers to bypass password checks by entering a blank password...

Cross-Site Request Forgery (CSRF)

symfony is vulnerable to cross-site request forgery CSRF attacks. The attacks are possible because it allows the injection of magic bytes via JSONP responses in JsonResponse.php...

Timing Attack

symfony/security is vulnerable to timing attacks. The attacks are possible because BasePasswordEncoder hashes are not compared using constant time...

Zomato: Potential server misconfiguration leads to disclosure of vendor/ directory

Hi, Apologies for the weakness label, it was the closest I could find for what appears to be a server misconfiguration. Typically, in MVC frameworks like Slim which I see you are using here, Symfony, Laravel, etc., the front controller is the only thing exposed, leaving vendor/, logs/, and others...

Razer US: Database credentials leak on the https://razer-id.razerzone.com/

The tester discovered database parameters left around in a YAML file that was publicly visible. The credentials were for a database that was no longer in use and never stored sensitive data, but we consider this a good find anyway because this was out of bounds of our security practices. I...

Hijacking Autoloader

symfony/class-loader is susceptible to the hijacking of the autoloader. The vulnerability exists because it does not prevent the ability to access the loader instance, resulting in the auto-outputting or revealing unwanted information...

Fedora Update for php-symfony FEDORA-2017-4fcbd8a4c3

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE attacks. The Yaml::parse allows attackers to execute PHP code through a PHP file...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE. A malicious user can pass a serialized PHP object to YAML:parse or Yaml\Parser::parse functions to inject and execute arbitrary code...

Arbitrary Code Injection

Symfony is vulnerable to arbitrary code injection attacks. A malicious user can inject and execute arbitrary PHP code with a language="php" attribute of a SCRIPT element through the Symfony\Component\HttpKernel\HttpCache class. This vulnerability only affects applications with ESI or SSI support...