CVE-2022-24871

Shopware SSRF vulnerability (CVE-2022-24871) enables an attacker to abuse the Admin SDK on the server to read or update internal resources. Affected: Shopware platform; current fix is upgrade to 6.4.10.1. For 6.1/6.2/6.3, security measures via a plugin are available. No public workaround document...

The vulnerability of the SyliusGridBundle e-commerce platform for Symfony applications, related to the lack of protection for SQL query structures, allows attackers to execute arbitrary SQL queries.

The vulnerability of the SyliusGridBundle e-commerce platform for Symfony applications is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries remotely...

Sylius 信息泄露漏洞

Sylius is a set of open source e-commerce platform based on the Symfony framework from the Polish company Sylius. Sylius has an information disclosure vulnerability, and no details of the vulnerability are currently available...

CVE-2022-24744 Insufficient Session Expiration in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3...

CVE-2022-24747 HTTP caching is marking private HTTP headers as public

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. Affected versions of shopware do no properly set sensitive HTTP headers to be non-cacheable. If there is an HTTP cache between the server and client then headers may be exposed via HTTP...

CVE-2022-24748 Incorrect Authentication in shopware

Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In versions prior to 6.4.8.2 it is possible to modify customers and to create orders without App Permission. This issue is a result of improper api route checking. Users are advised to upgra...

CVE-2022-23601 CSRF token missing in Symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the...

PT-2022-6951 · Symfony · Symfony

Name of the Vulnerable Software and Affected Versions: Symfony versions prior to the patch versions listed Description: The issue is related to insufficient authentication of executed requests in the Symfony framework, which can allow a remote attacker to perform a CSRF attack. The Symfony form...

CVE-2021-43835

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not...

CVE-2021-43836

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18...

Design/Logic Flaw

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not...

CVE-2021-43836

CVE-2021-43836 affects Sulu, an open-source PHP CMS based on Symfony. Affected versions expose an arbitrary local file read via a PHP file include, which in default configurations can also enable remote code execution. Root cause: vulnerability in the SymfonyExpressionTokenProvider handling in th...

CVE-2021-43835 Privilege escalation in the Sulu Admin panel

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions Sulu users who have access to any subset of the admin UI are able to elevate their privilege. Over the API it was possible for them to give themselves permissions to areas which they did not...

SULU Sulu 安全漏洞

Sulu is an extensible, PHP-based open source content management system on the Symfony framework from the Austrian company Sulu SULU.Sulu suffers from a security vulnerability that could be exploited by an attacker to elevate its privileges and access content it would otherwise not have access to...

SULU Sulu 路径遍历漏洞

Sulu is an extensible, PHP-based open source content management system on the Symfony framework from Austria's Sulu SULU.Sulu suffers from a path traversal vulnerability that can be exploited by attackers to read arbitrary local files via PHP file inclusion...

Sensio Labs Symfony 安全漏洞

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools that can be used to quickly create complex web programs. Symfony suffers from a security vulnerability that stem...

SULU Sulu Cross-Site Scripting Vulnerability

SULU Sulu is an extensible, PHP-based open source content management system on Symfony framework from Sulu SULU Austria. Sulu suffers from a cross-site scripting vulnerability that stems from a stored cross-site scripting attack in versions prior to 1.6.43. An attacker can exploit the vulnerabili...

Cross site scripting

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection cross-site-scripting in the collection title. The problem is patched in version 1.6.41. As a workaround, on...

Sylius Unauthorized Access Vulnerability

Sylius is a Polish company Sylius set of open source e-commerce platform based on the Symfony framework . A security vulnerability exists in Sylius versions prior to 1.9.5 and 1.10.0-RC, which stems from the fact that some of the details of an order placed in Sylius order ID, order number, total...

Sensio Labs Symfony 授权问题漏洞

Symfony is a PHP framework based on the MVC architecture and is free software, distributed under the MIT License. Symfony suffers from an elevation of privilege vulnerability that can be exploited by an attacker to gain access to all firewalls by sending a specially crafted request...