Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/symfony/symfony@2.7.36
Typecomposer
Namespacesymfony
Namesymfony
Version2.7.36
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.8.52
Latest_non_vulnerable_version8.0.12
Affected_by_vulnerabilities
0
url VCID-1y96-v19f-tkgg
vulnerability_id VCID-1y96-v19f-tkgg
summary 
Improper Input Validation
An issue was discovered in `HttpKernel` in Symfony When using `HttpCache`, the values of the `X-Forwarded-Host` headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-14774
reference_id
reference_type
scores
0
value 0.00166
scoring_system epss
scoring_elements 0.37318
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-14774
1
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
2
reference_url https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
3
reference_url https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
4
reference_url https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
5
reference_url https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
6
reference_url https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
7
reference_url https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
8
reference_url https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-14774
reference_id CVE-2018-14774
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-14774
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.49
purl pkg:composer/symfony/symfony@2.7.49
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-qqd1-smb1-sbe8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.49
1
url pkg:composer/symfony/symfony@2.8.44
purl pkg:composer/symfony/symfony@2.8.44
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.44
2
url pkg:composer/symfony/symfony@3.3.18
purl pkg:composer/symfony/symfony@3.3.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.18
3
url pkg:composer/symfony/symfony@3.4.14
purl pkg:composer/symfony/symfony@3.4.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.14
4
url pkg:composer/symfony/symfony@4.0.14
purl pkg:composer/symfony/symfony@4.0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.14
5
url pkg:composer/symfony/symfony@4.1.3
purl pkg:composer/symfony/symfony@4.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-kktw-gsen-jyd8
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.3
aliases CVE-2018-14774, GHSA-66p6-7p29-55p9
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1y96-v19f-tkgg
1
url VCID-23hr-yznx-c3fb
vulnerability_id VCID-23hr-yznx-c3fb
summary 
Improper Authentication
In Symfony, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-10911
reference_id
reference_type
scores
0
value 0.00272
scoring_system epss
scoring_elements 0.50835
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-10911
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml
4
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
5
reference_url https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-10911
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-10911
7
reference_url https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
8
reference_url https://www.synology.com/security/advisory/Synology_SA_19_19
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.synology.com/security/advisory/Synology_SA_19_19
9
reference_url https://symfony.com/cve-2019-10911
reference_id CVE-2019-10911
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-10911
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.51
purl pkg:composer/symfony/symfony@2.7.51
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.51
1
url pkg:composer/symfony/symfony@2.8.50
purl pkg:composer/symfony/symfony@2.8.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.50
2
url pkg:composer/symfony/symfony@3.4.26
purl pkg:composer/symfony/symfony@3.4.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.26
3
url pkg:composer/symfony/symfony@4.1.12
purl pkg:composer/symfony/symfony@4.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-jqh6-rwsw-73bs
6
vulnerability VCID-kktw-gsen-jyd8
7
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.12
4
url pkg:composer/symfony/symfony@4.2.7
purl pkg:composer/symfony/symfony@4.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-3kvp-hnpd-gbcq
2
vulnerability VCID-9m8x-djng-8ye3
3
vulnerability VCID-jqh6-rwsw-73bs
4
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.7
aliases CVE-2019-10911, GHSA-cchx-mfrc-fwqr
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-23hr-yznx-c3fb
2
url VCID-37et-21qw-skd7
vulnerability_id VCID-37et-21qw-skd7
summary 
Improper Input Validation
If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-18888
reference_id
reference_type
scores
0
value 0.0231
scoring_system epss
scoring_elements 0.85061
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-18888
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
4
reference_url https://github.com/symfony/symfony/releases/tag/v4.3.8
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/releases/tag/v4.3.8
5
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
8
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
10
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-18888
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-18888
12
reference_url https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
13
reference_url https://symfony.com/blog/symfony-4-3-8-released
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/symfony-4-3-8-released
14
reference_url https://symfony.com/cve-2019-18888
reference_id CVE-2019-18888
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-18888
fixed_packages
0
url pkg:composer/symfony/symfony@2.8.52
purl pkg:composer/symfony/symfony@2.8.52
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.52
1
url pkg:composer/symfony/symfony@3.4.35
purl pkg:composer/symfony/symfony@3.4.35
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.35
2
url pkg:composer/symfony/symfony@4.2.12
purl pkg:composer/symfony/symfony@4.2.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.12
3
url pkg:composer/symfony/symfony@4.3.8
purl pkg:composer/symfony/symfony@4.3.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.3.8
aliases CVE-2019-18888, GHSA-xhh6-956q-4q69
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-37et-21qw-skd7
3
url VCID-6c6t-kmb3-2qcm
vulnerability_id VCID-6c6t-kmb3-2qcm
summary 
Cross-site Scripting
In Symfony, validation messages are not escaped, which can lead to XSS when user input is included.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-10909
reference_id
reference_type
scores
0
value 0.00355
scoring_system epss
scoring_elements 0.58063
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-10909
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
5
reference_url https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
6
reference_url https://www.drupal.org/sa-core-2019-005
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.drupal.org/sa-core-2019-005
7
reference_url https://www.synology.com/security/advisory/Synology_SA_19_19
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.synology.com/security/advisory/Synology_SA_19_19
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-10909
reference_id CVE-2019-10909
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-10909
9
reference_url https://symfony.com/cve-2019-10909
reference_id CVE-2019-10909
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-10909
10
reference_url https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
reference_id CVE-2019-10909-ESCAPE-VALIDATION-MESSAGES-IN-THE-PHP-TEMPLATING-ENGINE
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.51
purl pkg:composer/symfony/symfony@2.7.51
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.51
1
url pkg:composer/symfony/symfony@2.8.50
purl pkg:composer/symfony/symfony@2.8.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.50
2
url pkg:composer/symfony/symfony@3.4.26
purl pkg:composer/symfony/symfony@3.4.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.26
3
url pkg:composer/symfony/symfony@4.1.12
purl pkg:composer/symfony/symfony@4.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-jqh6-rwsw-73bs
6
vulnerability VCID-kktw-gsen-jyd8
7
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.12
4
url pkg:composer/symfony/symfony@4.2.7
purl pkg:composer/symfony/symfony@4.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-3kvp-hnpd-gbcq
2
vulnerability VCID-9m8x-djng-8ye3
3
vulnerability VCID-jqh6-rwsw-73bs
4
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.7
aliases CVE-2019-10909, GHSA-g996-q5r8-w7g2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6c6t-kmb3-2qcm
4
url VCID-7m45-bvbn-4qd3
vulnerability_id VCID-7m45-bvbn-4qd3
summary 
SQL Injection
In Symfony HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-10913
reference_id
reference_type
scores
0
value 0.00257
scoring_system epss
scoring_elements 0.49289
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-10913
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
3
reference_url https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-10913
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-10913
5
reference_url https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
6
reference_url https://symfony.com/cve-2019-10913
reference_id CVE-2019-10913
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-10913
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.51
purl pkg:composer/symfony/symfony@2.7.51
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.51
1
url pkg:composer/symfony/symfony@2.8.50
purl pkg:composer/symfony/symfony@2.8.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.50
2
url pkg:composer/symfony/symfony@3.4.26
purl pkg:composer/symfony/symfony@3.4.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.26
3
url pkg:composer/symfony/symfony@4.1.12
purl pkg:composer/symfony/symfony@4.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-jqh6-rwsw-73bs
6
vulnerability VCID-kktw-gsen-jyd8
7
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.12
4
url pkg:composer/symfony/symfony@4.2.7
purl pkg:composer/symfony/symfony@4.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-3kvp-hnpd-gbcq
2
vulnerability VCID-9m8x-djng-8ye3
3
vulnerability VCID-jqh6-rwsw-73bs
4
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.7
aliases CVE-2019-10913, GHSA-x92h-wmg2-6hp7
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7m45-bvbn-4qd3
5
url VCID-awma-bc9f-kfe2
vulnerability_id VCID-awma-bc9f-kfe2
summary 
Symfony Service IDs Allow Injection
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-10910
reference_id
reference_type
scores
0
value 0.11901
scoring_system epss
scoring_elements 0.93877
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-10910
1
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
2
reference_url https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb
3
reference_url https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b
4
reference_url https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
5
reference_url https://www.synology.com/security/advisory/Synology_SA_19_19
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://www.synology.com/security/advisory/Synology_SA_19_19
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-10910
reference_id CVE-2019-10910
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-10910
7
reference_url https://symfony.com/cve-2019-10910
reference_id CVE-2019-10910
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-10910
8
reference_url https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
reference_id CVE-2019-10910-CHECK-SERVICE-IDS-ARE-VALID
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
9
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
reference_id CVE-2019-10910.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
10
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
reference_id CVE-2019-10910.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
11
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
reference_id CVE-2019-10910.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
12
reference_url https://github.com/advisories/GHSA-pgwj-prpq-jpc2
reference_id GHSA-pgwj-prpq-jpc2
reference_type
scores
url https://github.com/advisories/GHSA-pgwj-prpq-jpc2
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.51
purl pkg:composer/symfony/symfony@2.7.51
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.51
1
url pkg:composer/symfony/symfony@2.8.50
purl pkg:composer/symfony/symfony@2.8.50
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.50
2
url pkg:composer/symfony/symfony@3.4.26
purl pkg:composer/symfony/symfony@3.4.26
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-jqh6-rwsw-73bs
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.26
3
url pkg:composer/symfony/symfony@4.1.12
purl pkg:composer/symfony/symfony@4.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-jqh6-rwsw-73bs
6
vulnerability VCID-kktw-gsen-jyd8
7
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.12
4
url pkg:composer/symfony/symfony@4.2.7
purl pkg:composer/symfony/symfony@4.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-37et-21qw-skd7
1
vulnerability VCID-3kvp-hnpd-gbcq
2
vulnerability VCID-9m8x-djng-8ye3
3
vulnerability VCID-jqh6-rwsw-73bs
4
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.7
aliases CVE-2019-10910, GHSA-pgwj-prpq-jpc2
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-awma-bc9f-kfe2
6
url VCID-djnm-e9r4-c3f5
vulnerability_id VCID-djnm-e9r4-c3f5
summary `DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` take the content of the `_target_path` parameter and generate a redirect response but no check is performed on the path, which could be an absolute URL to an external domain, opening redirect vulnerability. Open redirect vulnerability are not too much considered but they can be exploited for example to mount effective phishing attacks.
references
0
reference_url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
reference_id
reference_type
scores
url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16652
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-16652
reference_id
reference_type
scores
0
value 0.00222
scoring_system epss
scoring_elements 0.44837
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-16652
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16652.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16652.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2017-16652.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2017-16652.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16652.yaml
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16652.yaml
5
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
6
reference_url https://github.com/symfony/symfony/pull/24995
reference_id
reference_type
scores
url https://github.com/symfony/symfony/pull/24995
7
reference_url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-16652
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-16652
9
reference_url https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers
10
reference_url https://symfony.com/cve-2017-16652
reference_id CVE-2017-16652
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2017-16652
11
reference_url http://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers
reference_id CVE-2017-16652-OPEN-REDIRECT-VULNERABILITY-ON-SECURITY-HANDLERS
reference_type
scores
url http://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.38
purl pkg:composer/symfony/symfony@2.7.38
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38
1
url pkg:composer/symfony/symfony@2.8.31
purl pkg:composer/symfony/symfony@2.8.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.31
2
url pkg:composer/symfony/symfony@3.2.14
purl pkg:composer/symfony/symfony@3.2.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.14
3
url pkg:composer/symfony/symfony@3.3.13
purl pkg:composer/symfony/symfony@3.3.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.13
4
url pkg:composer/symfony/symfony@3.4.0-BETA5
purl pkg:composer/symfony/symfony@3.4.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.0-BETA5
5
url pkg:composer/symfony/symfony@4.0.0-BETA5
purl pkg:composer/symfony/symfony@4.0.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0-BETA5
aliases CVE-2017-16652, GHSA-r7p7-qr7p-2rrf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-djnm-e9r4-c3f5
7
url VCID-dsbx-q641-4fc7
vulnerability_id VCID-dsbx-q641-4fc7
summary 
Cross-Site Request Forgery (CSRF)
The current implementation of CSRF protection in Symfony does not use different tokens for HTTP and HTTPS.
references
0
reference_url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
reference_id
reference_type
scores
url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16653
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-16653
reference_id
reference_type
scores
0
value 0.00325
scoring_system epss
scoring_elements 0.55806
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-16653
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-csrf/CVE-2017-16653.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-csrf/CVE-2017-16653.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16653.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16653.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16653.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16653.yaml
5
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
6
reference_url https://github.com/symfony/symfony/commit/b4dbdd7cd8732483d585eacff3428c16b07ad15e
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/b4dbdd7cd8732483d585eacff3428c16b07ad15e
7
reference_url https://github.com/symfony/symfony/pull/24992
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/24992
8
reference_url https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https
9
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-16653
reference_id CVE-2017-16653
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-16653
11
reference_url https://symfony.com/cve-2017-16653
reference_id CVE-2017-16653
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2017-16653
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.38
purl pkg:composer/symfony/symfony@2.7.38
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38
1
url pkg:composer/symfony/symfony@2.8.31
purl pkg:composer/symfony/symfony@2.8.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.31
2
url pkg:composer/symfony/symfony@3.2.14
purl pkg:composer/symfony/symfony@3.2.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.14
3
url pkg:composer/symfony/symfony@3.3.13
purl pkg:composer/symfony/symfony@3.3.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.13
4
url pkg:composer/symfony/symfony@4.0.0
purl pkg:composer/symfony/symfony@4.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-p6f7-utd6-eqej
13
vulnerability VCID-qqd1-smb1-sbe8
14
vulnerability VCID-tx26-92jc-rkff
15
vulnerability VCID-uuk9-e5qy-rfgf
16
vulnerability VCID-vyug-krcw-jyef
17
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0
aliases CVE-2017-16653, GHSA-92x6-h2gr-8gxq
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dsbx-q641-4fc7
8
url VCID-ef86-hqv4-6kaz
vulnerability_id VCID-ef86-hqv4-6kaz
summary 
Cross-Site Request Forgery (CSRF)
By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11406
reference_id
reference_type
scores
0
value 0.00184
scoring_system epss
scoring_elements 0.39914
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11406
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml
5
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
6
reference_url https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d1
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
8
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11406
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11406
11
reference_url https://symfony.com/blog/cve-2018-11406-csrf-token-fixation
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-11406-csrf-token-fixation
12
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
13
reference_url https://symfony.com/cve-2018-11406
reference_id CVE-2018-11406
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2018-11406
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.48
purl pkg:composer/symfony/symfony@2.7.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.48
1
url pkg:composer/symfony/symfony@2.8.41
purl pkg:composer/symfony/symfony@2.8.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.41
2
url pkg:composer/symfony/symfony@3.3.17
purl pkg:composer/symfony/symfony@3.3.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.17
3
url pkg:composer/symfony/symfony@3.4.11
purl pkg:composer/symfony/symfony@3.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.11
4
url pkg:composer/symfony/symfony@4.0.11
purl pkg:composer/symfony/symfony@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-qqd1-smb1-sbe8
11
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.11
aliases CVE-2018-11406, GHSA-g4g7-q726-v5hg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ef86-hqv4-6kaz
9
url VCID-jqh6-rwsw-73bs
vulnerability_id VCID-jqh6-rwsw-73bs
summary 
Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
The UriSigner was subjectto timing attacks.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-18887
reference_id
reference_type
scores
0
value 0.00813
scoring_system epss
scoring_elements 0.74617
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-18887
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2019-18887.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2019-18887.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18887.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18887.yaml
3
reference_url https://github.com/symfony/symfony/releases/tag/v4.3.8
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/releases/tag/v4.3.8
4
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
5
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
7
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
8
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-18887
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-18887
11
reference_url https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
12
reference_url https://symfony.com/blog/symfony-4-3-8-released
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/symfony-4-3-8-released
13
reference_url https://symfony.com/cve-2019-18887
reference_id CVE-2019-18887
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2019-18887
fixed_packages
0
url pkg:composer/symfony/symfony@2.8.52
purl pkg:composer/symfony/symfony@2.8.52
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.52
1
url pkg:composer/symfony/symfony@3.4.35
purl pkg:composer/symfony/symfony@3.4.35
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.35
2
url pkg:composer/symfony/symfony@4.2.12
purl pkg:composer/symfony/symfony@4.2.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-kktw-gsen-jyd8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.2.12
3
url pkg:composer/symfony/symfony@4.3.8
purl pkg:composer/symfony/symfony@4.3.8
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.3.8
aliases CVE-2019-18887, GHSA-q8hg-pf8v-cxrv
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jqh6-rwsw-73bs
10
url VCID-nsuz-7sdv-abef
vulnerability_id VCID-nsuz-7sdv-abef
summary 
Insufficient Session Expiration
The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11386
reference_id
reference_type
scores
0
value 0.01086
scoring_system epss
scoring_elements 0.78244
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11386
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml
3
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
4
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
5
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
6
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11386
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11386
8
reference_url https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler
9
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
10
reference_url https://symfony.com/cve-2018-11386
reference_id CVE-2018-11386
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2018-11386
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.48
purl pkg:composer/symfony/symfony@2.7.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.48
1
url pkg:composer/symfony/symfony@2.8.41
purl pkg:composer/symfony/symfony@2.8.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.41
2
url pkg:composer/symfony/symfony@3.3.17
purl pkg:composer/symfony/symfony@3.3.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.17
3
url pkg:composer/symfony/symfony@3.4.11
purl pkg:composer/symfony/symfony@3.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.11
4
url pkg:composer/symfony/symfony@4.0.11
purl pkg:composer/symfony/symfony@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-qqd1-smb1-sbe8
11
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.11
aliases CVE-2018-11386, GHSA-r2rq-3h56-fqm4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nsuz-7sdv-abef
11
url VCID-qqd1-smb1-sbe8
vulnerability_id VCID-qqd1-smb1-sbe8
summary 
URL Rewrite vulnerability
An issue in Symfony arises from support for a (legacy) IIS header that lets users override the path in the request URL via the `X-Original-URL` or `X-Rewrite-URL` HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects `\Symfony\Component\HttpFoundation\Request::prepareRequestUri()` where `X-Original-URL` and `X_REWRITE_URL` are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-14773
reference_id
reference_type
scores
0
value 0.16652
scoring_system epss
scoring_elements 0.95049
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-14773
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-14773.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-14773.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-14773.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-14773.yaml
3
reference_url https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
4
reference_url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-14773
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-14773
6
reference_url https://seclists.org/bugtraq/2019/May/21
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://seclists.org/bugtraq/2019/May/21
7
reference_url https://www.debian.org/security/2019/dsa-4441
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2019/dsa-4441
8
reference_url https://www.drupal.org/SA-CORE-2018-005
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.drupal.org/SA-CORE-2018-005
9
reference_url http://www.securityfocus.com/bid/104943
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/104943
10
reference_url http://www.securitytracker.com/id/1041405
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securitytracker.com/id/1041405
11
reference_url https://security.archlinux.org/AVG-744
reference_id AVG-744
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-744
12
reference_url https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
reference_id CVE-2018-14773-REMOVE-SUPPORT-FOR-LEGACY-AND-RISKY-HTTP-HEADERS
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.49
purl pkg:composer/symfony/symfony@2.7.49
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-qqd1-smb1-sbe8
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.49
1
url pkg:composer/symfony/symfony@2.8.44
purl pkg:composer/symfony/symfony@2.8.44
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.44
2
url pkg:composer/symfony/symfony@3.3.18
purl pkg:composer/symfony/symfony@3.3.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.18
3
url pkg:composer/symfony/symfony@3.4.14
purl pkg:composer/symfony/symfony@3.4.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-6c6t-kmb3-2qcm
3
vulnerability VCID-7m45-bvbn-4qd3
4
vulnerability VCID-awma-bc9f-kfe2
5
vulnerability VCID-frbz-vpfe-vbh9
6
vulnerability VCID-jqh6-rwsw-73bs
7
vulnerability VCID-mew1-9shg-mugs
8
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.14
4
url pkg:composer/symfony/symfony@4.0.14
purl pkg:composer/symfony/symfony@4.0.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.14
5
url pkg:composer/symfony/symfony@4.1.3
purl pkg:composer/symfony/symfony@4.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-kktw-gsen-jyd8
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.1.3
aliases CVE-2018-14773, GHSA-8wgj-6wx8-h5hq
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qqd1-smb1-sbe8
12
url VCID-vyug-krcw-jyef
vulnerability_id VCID-vyug-krcw-jyef
summary 
Session Fixation
A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-11385
reference_id
reference_type
scores
0
value 0.00904
scoring_system epss
scoring_elements 0.76092
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-11385
1
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11385.yaml
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11385.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11385.yaml
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11385.yaml
4
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
5
reference_url https://github.com/symfony/symfony/commit/194caff28b56707ea98e746c6582c06acbb9bc3f
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/194caff28b56707ea98e746c6582c06acbb9bc3f
6
reference_url https://github.com/symfony/symfony/commit/fa5bf4b17d45ee32f41bd1a9abc3fb6c134ec89b
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/fa5bf4b17d45ee32f41bd1a9abc3fb6c134ec89b
7
reference_url https://github.com/symfony/symfony/commit/fad1e1f2ea336e85c889feece9d0e23fbfcf777d
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/fad1e1f2ea336e85c889feece9d0e23fbfcf777d
8
reference_url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
9
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV
10
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW
11
reference_url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-11385
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-11385
13
reference_url https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-guard-authentication
14
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
15
reference_url https://symfony.com/cve-2018-11385
reference_id CVE-2018-11385
reference_type
scores
0
value 8.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2018-11385
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.48
purl pkg:composer/symfony/symfony@2.7.48
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.48
1
url pkg:composer/symfony/symfony@2.8.41
purl pkg:composer/symfony/symfony@2.8.41
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.41
2
url pkg:composer/symfony/symfony@3.3.17
purl pkg:composer/symfony/symfony@3.3.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.17
3
url pkg:composer/symfony/symfony@3.4.11
purl pkg:composer/symfony/symfony@3.4.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-frbz-vpfe-vbh9
7
vulnerability VCID-jqh6-rwsw-73bs
8
vulnerability VCID-mew1-9shg-mugs
9
vulnerability VCID-qqd1-smb1-sbe8
10
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.11
4
url pkg:composer/symfony/symfony@4.0.11
purl pkg:composer/symfony/symfony@4.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-qqd1-smb1-sbe8
11
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.11
aliases CVE-2018-11385, GHSA-g4rg-rw65-8hfg
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vyug-krcw-jyef
13
url VCID-xdtu-22ad-63aq
vulnerability_id VCID-xdtu-22ad-63aq
summary 
Attacker can read all files content on the server
When a form is submitted by the user, the request handler classes of the Form component merge POST data (known as the `$_POST` array in plain PHP) and uploaded files data (known as the `$_FILES` array in plain PHP) into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a `FileType` is sent as normal `POST` data that could be interpreted as a locale file path on the server-side (for example, `file:///etc/passwd`). If the application did not perform any additional checks about the value submitted to the `FileType`, the contents of the given file on the server could have been exposed to the attacker.
references
0
reference_url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
reference_id
reference_type
scores
url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16790
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-16790
reference_id
reference_type
scores
0
value 0.00686
scoring_system epss
scoring_elements 0.72102
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-16790
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2017-16790.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2017-16790.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16790.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16790.yaml
4
reference_url https://github.com/symfony/form
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/form
5
reference_url https://github.com/symfony/symfony/pull/24993
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/24993
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-16790
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-16790
7
reference_url https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files
8
reference_url https://symfony.com/cve-2017-16790
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2017-16790
9
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
10
reference_url http://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files
reference_id CVE-2017-16790-ENSURE-THAT-SUBMITTED-DATA-ARE-UPLOADED-FILES
reference_type
scores
url http://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-files
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.38
purl pkg:composer/symfony/symfony@2.7.38
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38
1
url pkg:composer/symfony/symfony@2.8.31
purl pkg:composer/symfony/symfony@2.8.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.31
2
url pkg:composer/symfony/symfony@3.2.14
purl pkg:composer/symfony/symfony@3.2.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.14
3
url pkg:composer/symfony/symfony@3.3.13
purl pkg:composer/symfony/symfony@3.3.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.13
4
url pkg:composer/symfony/symfony@3.4.0-BETA5
purl pkg:composer/symfony/symfony@3.4.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.0-BETA5
5
url pkg:composer/symfony/symfony@4.0.0-BETA5
purl pkg:composer/symfony/symfony@4.0.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0-BETA5
aliases CVE-2017-16790, GHSA-cqqh-94r6-wjrg
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xdtu-22ad-63aq
14
url VCID-xj13-fspe-hfgv
vulnerability_id VCID-xj13-fspe-hfgv
summary 
An attacker can navigate to arbitrary directories via the dot-dot-slash attack
This package includes various bundle readers that are used to read resource bundles from the local filesystem. The `read()` methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a `URL` parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack.
references
0
reference_url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
reference_id
reference_type
scores
url http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16654
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-16654
reference_id
reference_type
scores
0
value 0.00543
scoring_system epss
scoring_elements 0.68074
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-16654
2
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/intl/CVE-2017-16654.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/intl/CVE-2017-16654.yaml
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16654.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16654.yaml
4
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
5
reference_url https://github.com/symfony/symfony/pull/24994
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/pull/24994
6
reference_url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-16654
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-16654
8
reference_url https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
9
reference_url https://symfony.com/cve-2017-16654
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://symfony.com/cve-2017-16654
10
reference_url https://www.debian.org/security/2018/dsa-4262
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.debian.org/security/2018/dsa-4262
11
reference_url http://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
reference_id CVE-2017-16654-INTL-BUNDLE-READERS-BREAKING-OUT-OF-PATHS
reference_type
scores
url http://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths
fixed_packages
0
url pkg:composer/symfony/symfony@2.7.38
purl pkg:composer/symfony/symfony@2.7.38
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-vyug-krcw-jyef
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.38
1
url pkg:composer/symfony/symfony@2.8.31
purl pkg:composer/symfony/symfony@2.8.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.8.31
2
url pkg:composer/symfony/symfony@3.2.14
purl pkg:composer/symfony/symfony@3.2.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23hr-yznx-c3fb
1
vulnerability VCID-37et-21qw-skd7
2
vulnerability VCID-3kvp-hnpd-gbcq
3
vulnerability VCID-6c6t-kmb3-2qcm
4
vulnerability VCID-7m45-bvbn-4qd3
5
vulnerability VCID-awma-bc9f-kfe2
6
vulnerability VCID-ef86-hqv4-6kaz
7
vulnerability VCID-frbz-vpfe-vbh9
8
vulnerability VCID-jqh6-rwsw-73bs
9
vulnerability VCID-mew1-9shg-mugs
10
vulnerability VCID-nsuz-7sdv-abef
11
vulnerability VCID-qqd1-smb1-sbe8
12
vulnerability VCID-tx26-92jc-rkff
13
vulnerability VCID-uuk9-e5qy-rfgf
14
vulnerability VCID-vyug-krcw-jyef
15
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.2.14
3
url pkg:composer/symfony/symfony@3.3.13
purl pkg:composer/symfony/symfony@3.3.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1y96-v19f-tkgg
1
vulnerability VCID-23hr-yznx-c3fb
2
vulnerability VCID-37et-21qw-skd7
3
vulnerability VCID-3kvp-hnpd-gbcq
4
vulnerability VCID-6c6t-kmb3-2qcm
5
vulnerability VCID-7m45-bvbn-4qd3
6
vulnerability VCID-awma-bc9f-kfe2
7
vulnerability VCID-ef86-hqv4-6kaz
8
vulnerability VCID-frbz-vpfe-vbh9
9
vulnerability VCID-jqh6-rwsw-73bs
10
vulnerability VCID-mew1-9shg-mugs
11
vulnerability VCID-nsuz-7sdv-abef
12
vulnerability VCID-qqd1-smb1-sbe8
13
vulnerability VCID-tx26-92jc-rkff
14
vulnerability VCID-uuk9-e5qy-rfgf
15
vulnerability VCID-vyug-krcw-jyef
16
vulnerability VCID-zeut-9wfp-q7et
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.3.13
4
url pkg:composer/symfony/symfony@3.4.0-BETA5
purl pkg:composer/symfony/symfony@3.4.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@3.4.0-BETA5
5
url pkg:composer/symfony/symfony@4.0.0-BETA5
purl pkg:composer/symfony/symfony@4.0.0-BETA5
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@4.0.0-BETA5
aliases CVE-2017-16654, GHSA-c49r-8gj6-768r
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xj13-fspe-hfgv
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.7.36