Deserialization Gadget chain in Swift Mailer dependancy

Summary Symfony 1 has a gadget chain due to vulnerable Swift Mailer dependency that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will enable remote code executio...

PT-2024-9246 · Symfony +1 · Symfony +1

Name of the Vulnerable Software and Affected Versions: Symfony version 7.07 Description: A security issue was identified in the FormLoginAuthenticator component of Symfony, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could...

CVE-2024-24807 Sulu is vulnerable to HTML Injection via Autocomplete Suggestion

Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...

CVE-2024-24807

CVE-2024-24807 — Sulu HTML Injection via Autocomplete Suggestion What is affected: Sulu CMS (PHP, Symfony) — specifically the auto-complete form used when creating Tag names. Root cause: HTML input in Tag name is executed when listed in the autocomplete, indicating inadequate input sanitization f...

neworleansrestaurants.com Cross Site Scripting vulnerability OBB-3846573

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the SessionStrategyListener function in the Symfony software development and web application management platform allows attackers to compromise the integrity of the protected information.

The vulnerability of the SessionStrategyListener function in the Symfony software development and management platform is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

The vulnerability of the Symfony software platform for developing and managing web applications allows attackers to exploit it to disclose sensitive information, perform phishing attacks, and carry out diskloading attacks.

The vulnerability of the Symfony software platform for developing and managing web applications exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to disclose sensitive information, perform phishing attacks, and...

Debian: Security Advisory (DLA-3664-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3664-1] symfony security update

Debian LTS Advisory DLA-3664-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 24, 2023 https://wiki.debian.org/LTS Package : symfony Version : 3.4.22+dfsg-2+deb10u3 CVE ID : CVE-2023-46734 Debian Bug : 1055774 Pierre Rudloff discovered a potential XSS...

Debian dla-3664 : php-symfony - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3664 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3664-1 [email protected] https://www.debian.org/lts/security/...

DLA-3664-1 symfony - security update

Bulletin has no description...

Session Fixation

symfony is vulnerable to Session Fixation. An attacker is able to steal session tokens from users of a vulnerable Symfony application. The attacker could then use the stolen session tokens to impersonate the users and access their accounts...

Cross Site Scripting (XSS)

symfony/symfony is vulnerable to Cross Site Scripting XSS. The vulnerability arises due to usage of unsafe filters in the getfilters method. CodeExtension uses issafe=html but fails to ensure the input is safe. An attacker can execute an XSS attack due to this misconfiguration...

Cross-Site-Scripting (XSS)

symfony is vulnerable to Cross Site Scripting. The vulnerability is due to a lack of validation in the webhookcontroller. The error message in WebhookController returns unescaped user-submitted input. An attacker can potentially trick a victim into clicking a link which will execute arbitrary...

Symfony potential Cross-site Scripting in WebhookController

Description The error message in WebhookController returns unescaped user-submitted input. Resolution WebhookController now doesn't return any user-submitted input in its response. The patch for this issue is available here for branch 6.3. Credits We would like to thank Maxime Aknin for reporting...

GHSA-72X2-5C85-6WMR Symfony potential Cross-site Scripting in WebhookController

Description The error message in WebhookController returns unescaped user-submitted input. Resolution WebhookController now doesn't return any user-submitted input in its response. The patch for this issue is available here for branch 6.3. Credits We would like to thank Maxime Aknin for reporting...

GHSA-Q847-2Q57-WMR3 Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

Description Some Twig filters in CodeExtension use "issafe=html" but don't actually ensure their input is safe. Resolution Symfony now escapes the output of the affected filters. The patch for this issue is available here for branch 4.4. Credits We would like to thank Pierre Rudloff for reporting...

Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters

Description Some Twig filters in CodeExtension use "issafe=html" but don't actually ensure their input is safe. Resolution Symfony now escapes the output of the affected filters. The patch for this issue is available here for branch 4.4. Credits We would like to thank Pierre Rudloff for reporting...

GHSA-M2WJ-R6G3-FXFX Symfony possible session fixation vulnerability

Description SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token...

Symfony possible session fixation vulnerability

Description SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token...