2239 matches found
Routes behind a firewall are accessible even when not logged in
More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...
Routes behind a firewall are accessible even when not logged in
More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
XML decoding attack vector through external entities
More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...
Security Release: Symfony 2.0.11 released
Symfony 2.0.11 has just been released and it contains a security vulnerability fix for the Serializer Component. If you are using the Serializer component, you should upgrade as soon as possible. The security vulnerability has been reported this morning by Sense of Security: "The XMLEncoder...
Security Release: Symfony 2.0.6
Symfony 2.0.6 has just been released. It addresses a security vulnerability in the EntityUserProvider as provided in the Doctrine bridge. If you let your users update their login/username from a form, and if you are using Doctrine as a user provider, then you are vulnerable and you should upgrade...
symfony 1.3.10 and 1.4.10: security releases
The core team would like to announce the immediate availability of symfony 1.3.10 and 1.4.10. These are security releases in response to Doctrine's security release over the weekend. We recommend everyone update immediately. From the Doctrine blog: Because of a SQL injection possibility we urge...
Уязвимость в sfWpCumulusPlugin для symfony
Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting уязвимости в плагине sfWpCumulusPlugin для symfony. Данная XSS уязвимость идентична XSS уязвимости в WP-Cumulus, т.к. приложение использует tagcloud.swf разработанный автором WP-Cumulus. Про миллионы флешек tagcloud.swf уязвимых к XSS атакам...
Security Release: symfony 1.3.6 and 1.4.6
New releases for symfony 1.3 and 1.4 have been packaged sooner than expected to address a security vulnerability reported yesterday. It is strongly recommended that all applications running symfony 1.3 and 1.4 upgrade to this latest release immediately. The Security Fix One of the enhancements...
symfony 1.3.5 and 1.4.5
The symfony core team is happy to announce the immediate availability of symfony versions 1.3.5 and 1.4.5. Read on for the details. Security Fix A vulnerability was discovered in Doctrine and Propel form classes that allowed a user to update a record other than the one presented in the form. The...
Security Release: 1.2.12, 1.3.3 and 1.4.3
A SQL injection vulnerability in the Doctrine admin generator was reported earlier today which has been addressed in these 1.2.12, 1.3.3 and 1.4.3 security releases. This vulnerability was limited to the Doctrine admin generator and did not affect the Propel admin generator or any other aspect of...
symfony 1.3.2 and 1.4.2
We have just released the latest stable versions of symfony: 1.3.2 and 1.4.2. These releases include numerous bug fixes and one security fix. The bundled version of Propel has also been updated to version 1.4.1. We recommend all 1.3.x and 1.4.x projects upgrade to these latest releases immediatel...
symfony 1.2.6: Security fix
In accordance with our security policy, we are releasing today symfony 1.2.6 to fix a security issue that has been spotted by the symfony core team. This post contains the description of the vulnerability and the description of the changes we have made to fix it. The affected symfony versions are...
symfony 1.1.4 released: Security fix
In accordance with our security policy, we are releasing today symfony 1.1.4 to fix a security issue that has been reported by a symfony user earlier today. This post contains the description of the vulnerability and the description of the changes we have made to fix it. The affected symfony...
Symphony 1.7.01 (non-patched) - Remote Code Execution
Symphony 1.7.01 non-patched - Remote Code Execution db-fetchRow0, $sql; ... ... ifisset$COOKIESYMCOOKIE $args = unserialize$COOKIESYMCOOKIE; $result = $this-login$args'username', $args'password', true, false; ------------------/source code--------------------- password value from cookie is not...
symfony 1.0.16 is out
symfony 1.0.16 is out and fixes an important security breach. This is the shortest changelog one may find between two releases: a one line file. r8922: fixed yml validator file can be overriden by a remote attacker 1617 The issue is described in ticket 1617. An attacker could bypass the validatio...
symfony 1.0.13 is out
symfony 1.0.13 has been released to fix an important bug in the tag helper. Strings were incorrectly escaped due to the change r7900 the 1.0.12 release. The missing regression test has now been added and the bug is fixed. The 1.1 branche has also been updated. Here is the changelog : r8176: Fixes...
symfony 1.0.12 is (finally) out !
After two months and more than 30 tickets closed, the 1.0.12 comes with spring. As it fixes an important security issue and windows plugins problems, we do strongly advise you to update your projects. Here is the changelog : r8019: sfWebRequest handles multi-dimensional file input fields backport...
symfony 1.0.5 released (security fix)
I've just released symfony 1.0.5. If you use the symfony built-in phpmailer and you do if you use the -sendMail method in your actions, you must upgrade to this release or apply the following patch: http://trac.symfony-project.com/trac/changeset/4380?format=diff&new=4380. PHPMailer has a remote...
