Symphony Security Vulnerabilities and Issues — Symphony CVE List

Lucene search

B3logSymphony

6 matches found

CVE•added 2024/02/05 11:15 p.m.•200 views

CVE-2024-23049

An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

9.8CVSS9.6AI score0.03752EPSS

CVE•added 2019/10/10 9:15 p.m.•98 views

CVE-2019-17488

b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.

6.1CVSS6AI score0.0024EPSS

CVE•added 2019/06/20 2:15 p.m.•85 views

CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user...

4.8CVSS4.8AI score0.00446EPSS

CVE•added 2017/11/15 3:29 a.m.•47 views

CVE-2017-16821

b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid.

5.4CVSS5.2AI score0.00191EPSS

CVE•added 2018/04/27 4:29 a.m.•40 views

CVE-2018-10469

b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI.

9.8CVSS9.6AI score0.00842EPSS

CVE•added 2019/02/25 3:29 p.m.•39 views

CVE-2019-9142

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.

6.1CVSS5.9AI score0.0024EPSS