CVE-2015-4050: Improper Access Control

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...

PT-2015-6398

Name of the Vulnerable Software and Affected Versions Symfony versions 2.3.19 through 2.3.28 Symfony versions 2.4.9 through 2.4.10 Symfony versions 2.5.4 through 2.5.11 Symfony versions 2.6.0 through 2.6.7 Description The issue allows remote attackers to bypass URL signing and security rules by...