Concrete CMS: Local File Inclusion Vulnerability in Concrete5 version 5.7.3.1

Concrete5 is vulnerable to a Local File Inclusion because it fails to properly validate the path for incoming requests during the dispatching process. This vulnerability exists because the path is retrieved using the Request::getPathInfo method from the Symfony framework, which allows to specify...

Sensio Labs Symfony PHP Code Injection Execution Vulnerability

Sensio Labs Symfony is a free, MVC-based PHP development framework. The Sensio Labs Symfony 'eval' function fails to adequately filter user input, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary code with WEB privileges...

Sensio Labs Symfony Security Bypass Vulnerability

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A security bypass vulnerability exists in Sensio Labs...

Fedora 22 : php-symfony-2.5.11-1.fc22 (2015-5504)

2.5.11 2015-04-01 - security 14167 CVE-2015-2308 nicolas-grekas - security 14166 CVE-2015-2309 neclimdul Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

[SECURITY] Fedora 22 Update: php-symfony-2.5.11-1.fc22

PHP framework for web projects...

Fedora 20 : php-symfony-2.5.11-1.fc20 (2015-5464)

2.5.11 2015-04-01 - security 14167 CVE-2015-2308 nicolas-grekas - security 14166 CVE-2015-2309 neclimdul Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

Fedora 21 : php-symfony-2.5.11-1.fc21 (2015-5457)

2.5.11 2015-04-01 - security 14167 CVE-2015-2308 nicolas-grekas - security 14166 CVE-2015-2309 neclimdul Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

Fedora Update for php-symfony FEDORA-2015-5464

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-symfony FEDORA-2015-5457

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2015-5706 · Symfony · Symfony

Name of the Vulnerable Software and Affected Versions: Symfony HttpFoundation component versions 2.0.X through 2.6.X Description: The issue affects the SymfonyComponentHttpFoundationRequest class, which has a mechanism to ensure it does not trust HTTP header values coming from a "non-trusted"...

Esi Code Injection

More info at https://symfony.com/cve-2015-2308...

Unsafe methods in the Request class

More info at https://symfony.com/cve-2015-2309...

Esi Code Injection

More info at https://symfony.com/cve-2015-2308...

Unsafe methods in the Request class

More info at https://symfony.com/cve-2015-2309...

CVE-2015-2308: Esi Code Injection

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpKernel component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they ar...

CVE-2015-2309: Unsafe methods in the Request class

Affected Versions All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue. This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as the...

Cross site scripting

Cross-site scripting XSS vulnerability in symfony/web/index.php/pim/viewEmployeeList in OrangeHRM before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the empsearchemployeenameempId parameter...

CVE-2013-5958

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

Design/Logic Flaw

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

CVE-2013-5958

The vulnerability CVE-2013-5958 affects the Symfony Security component: Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6. A long password can trigger an expensive PBKDF2 hash computation, leading to CPU-based denial of service. Remediation is upgrading ...