Search for packages
| purl | pkg:composer/cakephp/cakephp@2.0.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6x9m-nyfs-a7hq
Aliases: GHSA-q79m-c546-2g63 GMS-2023-71 |
CakePHP vulnerable to Denial of Service attack through XML payloads RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-ajr2-5q7d-j3be
Aliases: GHSA-j9q2-f9q7-jhgq GMS-2023-69 |
CakePHP SecurityComponent cross form submission issue Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues. |
Affected by 8 other vulnerabilities. |
|
VCID-cz9h-hf83-eycy
Aliases: GHSA-p76f-wr22-4rv6 GMS-2023-70 |
CakePHP vulnerable to Remote File Inclusion through View template name manipulation CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-qun9-tgkq-d7an
Aliases: GHSA-6hg4-vp5q-47mw GMS-2023-67 |
CakePHP allows direct access of prefixed controller actions Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-s536-vx42-xbhk
Aliases: GMS-2015-64 |
PHP Remote File Inclusion Remote File Inclusion through View template name manipulation. |
Affected by 5 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-saae-h7cg-q7cb
Aliases: GMS-2014-34 |
Improper Input Validation Forms secured by `SecurityComponent` could be submitted to any action without triggering SecurityComponents tampering protection. |
Affected by 8 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-yps8-ffx6-3fay
Aliases: GMS-2015-62 |
Uncontrolled Resource Consumption Denial of Service attack through XML payloads |
Affected by 5 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-zfgg-dd4t-zyhq
Aliases: GMS-2015-63 |
Direct access of prefixed controller actions Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters. If your authorization depends on the presence of the prefix routing key you should upgrade as soon as possible. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||