Symfony@2.6.4 Security Vulnerabilities and Issues — Symfony@2.6.4 CVE List

Lucene search

SensiolabsSymfony2.6.4

4 matches found

CVE•added 2015/06/02 2:59 p.m.•92 views

CVE-2015-4050

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security r...

4.3CVSS6.5AI score0.76192EPSS

CVE•added 2015/06/24 10:59 a.m.•67 views

CVE-2015-2308

Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.

6.8CVSS7.6AI score0.00543EPSS

CVE•added 2015/12/07 8:59 p.m.•61 views

CVE-2015-8125

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/Di...

7.5CVSS6.8AI score0.01008EPSS

CVE•added 2015/12/07 8:59 p.m.•53 views

CVE-2015-8124

Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.

6.8CVSS6.4AI score0.00247EPSS