Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-neyj-8fkw-fyb7
Summary
Symfony XML decoding attack vector through external entities
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system.
Aliases
0
alias GHSA-mmcv-fvq8-r9x3
Fixed_packages
0
url pkg:composer/symfony/symfony@2.0.11
purl pkg:composer/symfony/symfony@2.0.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-hzwd-mq3r-qfcb
16
vulnerability VCID-jdsd-3vnz-uygn
17
vulnerability VCID-jjqk-u4vs-tbba
18
vulnerability VCID-k37h-bhh2-myaj
19
vulnerability VCID-k8ze-h7fe-fkg2
20
vulnerability VCID-kgu6-gj5d-7bfx
21
vulnerability VCID-nsk8-bk5e-tbfh
22
vulnerability VCID-p1dw-w76f-gbfv
23
vulnerability VCID-qty4-cyfa-rugw
24
vulnerability VCID-qwcj-hq3g-2qd7
25
vulnerability VCID-rgh3-ef8t-k3ec
26
vulnerability VCID-rxbg-gmn6-kbeq
27
vulnerability VCID-rztj-ug83-dyga
28
vulnerability VCID-sfzy-423b-j3b4
29
vulnerability VCID-skth-cf6d-3ubr
30
vulnerability VCID-srrc-wxew-1fc6
31
vulnerability VCID-thtp-ehsj-t3ej
32
vulnerability VCID-u84h-sr6a-4uc7
33
vulnerability VCID-unuf-vj1b-qbhr
34
vulnerability VCID-wwhm-mrr3-v7h3
35
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.11
Affected_packages
0
url pkg:composer/symfony/symfony@2.0.0
purl pkg:composer/symfony/symfony@2.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-556v-rym3-6yax
4
vulnerability VCID-6cea-up73-y3hn
5
vulnerability VCID-6z5x-uwjt-uueq
6
vulnerability VCID-71vh-7wte-kfcx
7
vulnerability VCID-742s-vczp-tuh1
8
vulnerability VCID-7ms4-3hc6-8bgv
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-d1kp-7aht-9qa2
14
vulnerability VCID-fgxs-w84s-8kh3
15
vulnerability VCID-hzwd-mq3r-qfcb
16
vulnerability VCID-jdsd-3vnz-uygn
17
vulnerability VCID-jjqk-u4vs-tbba
18
vulnerability VCID-k37h-bhh2-myaj
19
vulnerability VCID-neyj-8fkw-fyb7
20
vulnerability VCID-p1dw-w76f-gbfv
21
vulnerability VCID-qty4-cyfa-rugw
22
vulnerability VCID-rgh3-ef8t-k3ec
23
vulnerability VCID-rxbg-gmn6-kbeq
24
vulnerability VCID-rztj-ug83-dyga
25
vulnerability VCID-sfzy-423b-j3b4
26
vulnerability VCID-srrc-wxew-1fc6
27
vulnerability VCID-thtp-ehsj-t3ej
28
vulnerability VCID-u84h-sr6a-4uc7
29
vulnerability VCID-unuf-vj1b-qbhr
30
vulnerability VCID-wwhm-mrr3-v7h3
31
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.0
1
url pkg:composer/symfony/symfony@2.0.4
purl pkg:composer/symfony/symfony@2.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-742s-vczp-tuh1
9
vulnerability VCID-7ms4-3hc6-8bgv
10
vulnerability VCID-9bzz-84cq-ykh2
11
vulnerability VCID-ahhz-bs6u-f3bc
12
vulnerability VCID-bdhj-np35-sybt
13
vulnerability VCID-bhfu-7788-fbhc
14
vulnerability VCID-bny7-h1nn-bkbc
15
vulnerability VCID-c8ar-82sr-fqej
16
vulnerability VCID-d1kp-7aht-9qa2
17
vulnerability VCID-fgxs-w84s-8kh3
18
vulnerability VCID-hzwd-mq3r-qfcb
19
vulnerability VCID-jdsd-3vnz-uygn
20
vulnerability VCID-jjqk-u4vs-tbba
21
vulnerability VCID-k37h-bhh2-myaj
22
vulnerability VCID-k8ze-h7fe-fkg2
23
vulnerability VCID-kgu6-gj5d-7bfx
24
vulnerability VCID-neyj-8fkw-fyb7
25
vulnerability VCID-nsk8-bk5e-tbfh
26
vulnerability VCID-p1dw-w76f-gbfv
27
vulnerability VCID-qty4-cyfa-rugw
28
vulnerability VCID-qwcj-hq3g-2qd7
29
vulnerability VCID-rgh3-ef8t-k3ec
30
vulnerability VCID-rxbg-gmn6-kbeq
31
vulnerability VCID-rztj-ug83-dyga
32
vulnerability VCID-sfzy-423b-j3b4
33
vulnerability VCID-skth-cf6d-3ubr
34
vulnerability VCID-srrc-wxew-1fc6
35
vulnerability VCID-thtp-ehsj-t3ej
36
vulnerability VCID-u84h-sr6a-4uc7
37
vulnerability VCID-unuf-vj1b-qbhr
38
vulnerability VCID-wwhm-mrr3-v7h3
39
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.4
2
url pkg:composer/symfony/symfony@2.0.5
purl pkg:composer/symfony/symfony@2.0.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-742s-vczp-tuh1
9
vulnerability VCID-7ms4-3hc6-8bgv
10
vulnerability VCID-9bzz-84cq-ykh2
11
vulnerability VCID-ahhz-bs6u-f3bc
12
vulnerability VCID-bdhj-np35-sybt
13
vulnerability VCID-bhfu-7788-fbhc
14
vulnerability VCID-bny7-h1nn-bkbc
15
vulnerability VCID-c8ar-82sr-fqej
16
vulnerability VCID-d1kp-7aht-9qa2
17
vulnerability VCID-fgxs-w84s-8kh3
18
vulnerability VCID-hzwd-mq3r-qfcb
19
vulnerability VCID-jdsd-3vnz-uygn
20
vulnerability VCID-jjqk-u4vs-tbba
21
vulnerability VCID-k37h-bhh2-myaj
22
vulnerability VCID-k8ze-h7fe-fkg2
23
vulnerability VCID-kgu6-gj5d-7bfx
24
vulnerability VCID-neyj-8fkw-fyb7
25
vulnerability VCID-nsk8-bk5e-tbfh
26
vulnerability VCID-p1dw-w76f-gbfv
27
vulnerability VCID-qty4-cyfa-rugw
28
vulnerability VCID-qwcj-hq3g-2qd7
29
vulnerability VCID-rgh3-ef8t-k3ec
30
vulnerability VCID-rxbg-gmn6-kbeq
31
vulnerability VCID-rztj-ug83-dyga
32
vulnerability VCID-sfzy-423b-j3b4
33
vulnerability VCID-skth-cf6d-3ubr
34
vulnerability VCID-srrc-wxew-1fc6
35
vulnerability VCID-thtp-ehsj-t3ej
36
vulnerability VCID-u84h-sr6a-4uc7
37
vulnerability VCID-unuf-vj1b-qbhr
38
vulnerability VCID-wwhm-mrr3-v7h3
39
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.5
3
url pkg:composer/symfony/symfony@2.0.6
purl pkg:composer/symfony/symfony@2.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-fgxs-w84s-8kh3
16
vulnerability VCID-hzwd-mq3r-qfcb
17
vulnerability VCID-jdsd-3vnz-uygn
18
vulnerability VCID-jjqk-u4vs-tbba
19
vulnerability VCID-k37h-bhh2-myaj
20
vulnerability VCID-k8ze-h7fe-fkg2
21
vulnerability VCID-kgu6-gj5d-7bfx
22
vulnerability VCID-neyj-8fkw-fyb7
23
vulnerability VCID-nsk8-bk5e-tbfh
24
vulnerability VCID-p1dw-w76f-gbfv
25
vulnerability VCID-qty4-cyfa-rugw
26
vulnerability VCID-qwcj-hq3g-2qd7
27
vulnerability VCID-rgh3-ef8t-k3ec
28
vulnerability VCID-rxbg-gmn6-kbeq
29
vulnerability VCID-rztj-ug83-dyga
30
vulnerability VCID-sfzy-423b-j3b4
31
vulnerability VCID-skth-cf6d-3ubr
32
vulnerability VCID-srrc-wxew-1fc6
33
vulnerability VCID-thtp-ehsj-t3ej
34
vulnerability VCID-u84h-sr6a-4uc7
35
vulnerability VCID-unuf-vj1b-qbhr
36
vulnerability VCID-wwhm-mrr3-v7h3
37
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.6
4
url pkg:composer/symfony/symfony@2.0.7
purl pkg:composer/symfony/symfony@2.0.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-fgxs-w84s-8kh3
16
vulnerability VCID-hzwd-mq3r-qfcb
17
vulnerability VCID-jdsd-3vnz-uygn
18
vulnerability VCID-jjqk-u4vs-tbba
19
vulnerability VCID-k37h-bhh2-myaj
20
vulnerability VCID-k8ze-h7fe-fkg2
21
vulnerability VCID-kgu6-gj5d-7bfx
22
vulnerability VCID-neyj-8fkw-fyb7
23
vulnerability VCID-nsk8-bk5e-tbfh
24
vulnerability VCID-p1dw-w76f-gbfv
25
vulnerability VCID-qty4-cyfa-rugw
26
vulnerability VCID-qwcj-hq3g-2qd7
27
vulnerability VCID-rgh3-ef8t-k3ec
28
vulnerability VCID-rxbg-gmn6-kbeq
29
vulnerability VCID-rztj-ug83-dyga
30
vulnerability VCID-sfzy-423b-j3b4
31
vulnerability VCID-skth-cf6d-3ubr
32
vulnerability VCID-srrc-wxew-1fc6
33
vulnerability VCID-thtp-ehsj-t3ej
34
vulnerability VCID-u84h-sr6a-4uc7
35
vulnerability VCID-unuf-vj1b-qbhr
36
vulnerability VCID-wwhm-mrr3-v7h3
37
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.7
5
url pkg:composer/symfony/symfony@2.0.9
purl pkg:composer/symfony/symfony@2.0.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-fgxs-w84s-8kh3
16
vulnerability VCID-hzwd-mq3r-qfcb
17
vulnerability VCID-jdsd-3vnz-uygn
18
vulnerability VCID-jjqk-u4vs-tbba
19
vulnerability VCID-k37h-bhh2-myaj
20
vulnerability VCID-k8ze-h7fe-fkg2
21
vulnerability VCID-kgu6-gj5d-7bfx
22
vulnerability VCID-neyj-8fkw-fyb7
23
vulnerability VCID-nsk8-bk5e-tbfh
24
vulnerability VCID-p1dw-w76f-gbfv
25
vulnerability VCID-qty4-cyfa-rugw
26
vulnerability VCID-qwcj-hq3g-2qd7
27
vulnerability VCID-rgh3-ef8t-k3ec
28
vulnerability VCID-rxbg-gmn6-kbeq
29
vulnerability VCID-rztj-ug83-dyga
30
vulnerability VCID-sfzy-423b-j3b4
31
vulnerability VCID-skth-cf6d-3ubr
32
vulnerability VCID-srrc-wxew-1fc6
33
vulnerability VCID-thtp-ehsj-t3ej
34
vulnerability VCID-u84h-sr6a-4uc7
35
vulnerability VCID-unuf-vj1b-qbhr
36
vulnerability VCID-wwhm-mrr3-v7h3
37
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.9
6
url pkg:composer/symfony/symfony@2.0.10
purl pkg:composer/symfony/symfony@2.0.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-23wm-y6hh-hfd3
1
vulnerability VCID-2hua-7wbd-tqbx
2
vulnerability VCID-446x-j2gr-f3a2
3
vulnerability VCID-4num-z8cg-83gt
4
vulnerability VCID-556v-rym3-6yax
5
vulnerability VCID-6cea-up73-y3hn
6
vulnerability VCID-6z5x-uwjt-uueq
7
vulnerability VCID-71vh-7wte-kfcx
8
vulnerability VCID-9bzz-84cq-ykh2
9
vulnerability VCID-ahhz-bs6u-f3bc
10
vulnerability VCID-bdhj-np35-sybt
11
vulnerability VCID-bhfu-7788-fbhc
12
vulnerability VCID-bny7-h1nn-bkbc
13
vulnerability VCID-c8ar-82sr-fqej
14
vulnerability VCID-d1kp-7aht-9qa2
15
vulnerability VCID-fgxs-w84s-8kh3
16
vulnerability VCID-hzwd-mq3r-qfcb
17
vulnerability VCID-jdsd-3vnz-uygn
18
vulnerability VCID-jjqk-u4vs-tbba
19
vulnerability VCID-k37h-bhh2-myaj
20
vulnerability VCID-k8ze-h7fe-fkg2
21
vulnerability VCID-kgu6-gj5d-7bfx
22
vulnerability VCID-neyj-8fkw-fyb7
23
vulnerability VCID-nsk8-bk5e-tbfh
24
vulnerability VCID-p1dw-w76f-gbfv
25
vulnerability VCID-qty4-cyfa-rugw
26
vulnerability VCID-qwcj-hq3g-2qd7
27
vulnerability VCID-rgh3-ef8t-k3ec
28
vulnerability VCID-rxbg-gmn6-kbeq
29
vulnerability VCID-rztj-ug83-dyga
30
vulnerability VCID-sfzy-423b-j3b4
31
vulnerability VCID-skth-cf6d-3ubr
32
vulnerability VCID-srrc-wxew-1fc6
33
vulnerability VCID-thtp-ehsj-t3ej
34
vulnerability VCID-u84h-sr6a-4uc7
35
vulnerability VCID-unuf-vj1b-qbhr
36
vulnerability VCID-wwhm-mrr3-v7h3
37
vulnerability VCID-xmur-ps51-myfu
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/symfony/symfony@2.0.10
References
0
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2012-02-24.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2012-02-24.yaml
1
reference_url https://github.com/symfony/symfony
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony
2
reference_url https://github.com/symfony/symfony/commit/3e64d36cbdc34acaa82e0e6318112cd2eacb6fec
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/symfony/symfony/commit/3e64d36cbdc34acaa82e0e6318112cd2eacb6fec
3
reference_url https://symfony.com/blog/security-release-symfony-2-0-11-released
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://symfony.com/blog/security-release-symfony-2-0-11-released
4
reference_url https://github.com/advisories/GHSA-mmcv-fvq8-r9x3
reference_id GHSA-mmcv-fvq8-r9x3
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mmcv-fvq8-r9x3
Weaknesses
0
cwe_id 502
name Deserialization of Untrusted Data
description The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score9.0 - 10.0
Exploitability0.5
Weighted_severity9.0
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-neyj-8fkw-fyb7