Search for packages
| purl | pkg:composer/friendsofsymfony/user-bundle@1.2.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-98wp-9e1h-yfgg
Aliases: GMS-2012-7 |
Improper Authentication user-bundle contains a security issue where the session could be hijacked. |
Affected by 2 other vulnerabilities. |
|
VCID-cp9j-3948-mud8
Aliases: GMS-2014-38 |
Insufficient Entropy Entropy is lost in the `TokenGenerator`. |
Affected by 1 other vulnerability. |
|
VCID-fkq5-7t4p-jbdk
Aliases: GHSA-6mjq-9x4w-m3w9 |
FOSUserBundle Session Hijacking Vulnerability Versions of FOSUserBundle from 1.2.x to 1.2.4 have been found to contain a security vulnerability related to session hijacking. This issue has been addressed in version 1.2.4, and users are strongly advised to upgrade to the latest version to prevent potential session-related security risks. |
Affected by 2 other vulnerabilities. |
|
VCID-ky5a-sata-5yf6
Aliases: CVE-2013-5750 GHSA-9mpf-g3fc-9rgv |
Uncontrolled Resource Consumption The login form in the FriendsOfSymfony FOSUserBundle bundle for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-nnxf-zbvz-1qdb
Aliases: GHSA-8wx3-8m4x-g5h4 |
FOSUserBundle User Identity Validation Vulnerability Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing. |
Affected by 2 other vulnerabilities. |
|
VCID-sv3j-tu9a-pucg
Aliases: GMS-2012-6 |
Improper Access Control User refreshing to check the identity by primary key instead of username. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||