CVE-2012-6432

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /internal substring...

Spoofing

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string...

CVE-2012-6431

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string...

CVE-2012-6432

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /internal substring...

CVE-2012-6432

Summary (concrete details from provided sources): CVE-2012-6432 affects Symfony 2.0.x up to 2.0.19, Symfony 2.1.x up to 2.1.4, and 2.2-dev, when the internal routes configuration is enabled. A vulnerability in the internal routing mechanism, via URIs starting with /_internal, allows an attacker t...

CVE-2012-6431

CVE-2012-6431 affects Symfony 2.0.x (from 2.0.0 through 2.0.19), where the Routing and Security components mishandle URL-encoded data, allowing a doubly encoded string to bypass URI restrictions. The root cause is a double-decoding flow: UrlMatcher decodes the path again while RequestMatcher does...

Security release: Symfony 2.0.20 and 2.1.5 released

Log in to add a reaction to this post add a reaction ❤️ 👍 🚀 Symfony 2.0.20 and Symfony 2.1.5 have just been released and they both contain two security fixes. CVE-2012-6431: Routes behind a firewall are accessible even when not logged in Affected versions All versions from 2.0.0 to 2.0.19 are...

Code execution vulnerability via the "internal" routes

More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...

CVE-2012-5574

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request...

Cross site request forgery (csrf)

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request...

CVE-2012-5574

lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request...

CVE-2012-5574

CVE-2012-5574 affects Symfony CMS: lib/form/sfForm.class.php before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request, enabling information disclosure. The entry is confirmed across multiple feeds (NVD, Gentoo GLSA 201405-25, OpenVAS entries) and remediation is t...

Fedora Update for php-symfony-symfony FEDORA-2012-19235

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for php-symfony-symfony FEDORA-2012-19235

Check for the Version of php-symfony-symfony OpenVAS Vulnerability Test Fedora Update for php-symfony-symfony FEDORA-2012-19235 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/...

XSS vulnerability in swfupload in TinyMCE, SPIP, Radiant CMS, AionWeb, Liferay Portal, SurgeMail, symfony

Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in AionWeb, Magento, Liferay Portal, SurgeMail, symfony and that this hole is available in many other web applications. In previous letters I've wrote...

Fedora Update for php-symfony-symfony FEDORA-2012-19195

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for php-symfony-symfony FEDORA-2012-19195

Check for the Version of php-symfony-symfony OpenVAS Vulnerability Test Fedora Update for php-symfony-symfony FEDORA-2012-19195 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/...

Fedora 17 : php-symfony-symfony-1.4.20-2.fc17 (2012-19235)

upstream 1.4.20 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Fedora 16 : php-symfony-symfony-1.4.20-2.fc16 (2012-19195)

upstream 1.4.20 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

[SECURITY] Fedora 16 Update: php-symfony-symfony-1.4.20-2.fc16

Symfony is a complete framework designed to optimize the development of web applications by way of several key features. For starters, it separates a w eb application's business rules, server logic, and presentation views. It contains numerous tools and classes aimed at shortening the development...