9 matches found
Remote Code Execution (RCE)
zenstruck/collection is vulnerable to Remote Code Execution RCE. The vulnerability is due to a lack of sanitizing system calls in EntityRepository::find or query which allows an attacker to execute malicious code in the system...
GHSA-7XR2-8FF7-6FJQ zenstruck/collection passing callable string to EntityRepository::find() and query()
Impact Passing callable strings ie system caused the function to be executed. Patches Fixed in v0.2.1. Workarounds Do not allow passing user strings to EntityRepository::find or query. References Fix commit...
CVE-2023-37473
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
Code injection
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
CVE-2023-37473
The CVE affects zenstruck/collections (PHP library). The vulnerability arises when user input is passed as a callable string (e.g., system) to EntityRepository::find() or query(), allowing arbitrary code execution. The issue has been fixed in commit f4b1c488206e1b1581b06fcd331686846f13f19c and re...
CVE-2023-37473 Limited code execution in zenstruck/collections
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
CVE-2023-37473 Limited code execution in zenstruck/collections
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
CVE-2023-37473 Limited code execution in zenstruck/collections
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...
CVE-2023-37473: Improper Neutralization of Special Elements in Output Used by a Downstream Component
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...