CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11408: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2018-11408...

CVE-2018-11408: Open redirect vulnerability on security handlers

More info at https://symfony.com/cve-2018-11408...

CVE-2018-11386: Denial of service when using PDOSessionHandler

More info at https://symfony.com/cve-2018-11386...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11386: Denial of service when using PDOSessionHandler

More info at https://symfony.com/cve-2018-11386...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

More info at https://symfony.com/cve-2018-11385...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11406: CSRF Token Fixation

More info at https://symfony.com/cve-2018-11406...

CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password

Affected versions Symfony 2.8.0 to 2.8.36, 3.3.0 to 3.3.16, 3.4.0 to 3.4.6, and 4.0.0 to 4.0.6 versions of the Symfony LDAP component are affected by this security issue. The issue has been fixed in Symfony 2.8.37, 3.3.17, 3.4.7, and 4.0.7. 4.1.0 has also been fixed before its final release. Note...

CVE-2018-11408: Open redirect vulnerability on security handlers

Affected versions Symfony 2.7.0 to 2.7.47, 2.8.0 to 2.8.40, 3.3.0 to 3.3.16, 3.4.0 to 3.4.10, and 4.0.0 to 4.0.10 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11. 4.1.0 has also been fix...

CVE-2018-11406: CSRF Token Fixation

Affected versions Symfony 2.7.0 to 2.7.47, 2.8.0 to 2.8.40, 3.3.0 to 3.3.16, 3.4.0 to 3.4.10, and 4.0.0 to 4.0.10 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11. 4.1.0 has also been fix...

CVE-2018-11386: Denial of service when using PDOSessionHandler

Affected versions Symfony 2.7.0 to 2.7.47, 2.8.0 to 2.8.40, 3.3.0 to 3.3.16, 3.4.0 to 3.4.10, and 4.0.0 to 4.0.10 versions of the Symfony http-foundation component are affected by this security issue. The issue has been fixed in Symfony 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11. 4.1.0 has also...

CVE-2018-11385: Session Fixation Issue for Guard Authentication

Affected versions Symfony 2.7.0 to 2.7.47, 2.8.0 to 2.8.40, 3.3.0 to 3.3.16, 3.4.0 to 3.4.10 and 4.0.0 to 4.0.10 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.48, 2.8.41, 3.3.17, 3.4.11, and 4.0.11. Note that no fixes are...

Shopware 5.3.7 Cross Site Request Forgery Vulnerability

Shopware versions 4.0.1 through 5.3.7 suffer from a cross site request forgery vulnerability. Malicious, third-party websites may abuse this API to list, add or remove products from a user's cart. Shopware Cart Accessible by Third-Party Websites RedTeam Pentesting discovered that the shopping car...

[SECURITY] Fedora 27 Update: php-symfony4-4.0.1-1.fc27

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

Denial Of Service (DoS)

symfony/symfony and symfony/http-foundation are vulnerable to denial of service DoS attacks. The attacks can happen because it uses the pregmatch method rather that the pregreplace function when checking HTTP host name input from user in the getHost function...

Timing Attack

symfony/form is vulnerable to timing attacks. The library is vulnerable because they do not compare CSRF Tokens in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid token...

Open Redirect

Symfony is vulnerable to open redirects. The library does not validate the targetpath parameter when generating a redirect response, allowing a malicious user to pass a malicious URL to generate a redirect link...