Search for packages
| purl | pkg:composer/symfony/security@2.3.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-556v-rym3-6yax
Aliases: CVE-2018-11406 GHSA-g4g7-q726-v5hg |
Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation. |
Affected by 5 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-5u5z-qzg2-sbhg
Aliases: CVE-2015-8125 GHSA-g97c-jfx6-xvxh |
Information Exposure Through Timing Discrepancy Symfony allows remote attackers to have unspecified impact via a timing attack. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-71vh-7wte-kfcx
Aliases: CVE-2018-11385 GHSA-g4rg-rw65-8hfg |
Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker. |
Affected by 5 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-ahmf-nthw-ufaq
Aliases: CVE-2016-1902 GHSA-jjx5-fq5g-8xpc |
Cryptographic Issues The `nextBytes` function in the `SecureRandom` class in Symfony does not properly generate random numbers when used with PHP without the `paragonie/random_compat` library and the `openssl_random_pseudo_bytes` function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. |
Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-fy39-ys3p-5ucm
Aliases: CVE-2015-8124 GHSA-j5jh-hpr4-h332 |
Session Fixation Session fixation vulnerability in the `Remember Me` login feature in Symfony allows remote attackers to hijack web sessions via a session id. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 7 other vulnerabilities. |
|
VCID-nsk8-bk5e-tbfh
Aliases: CVE-2016-4423 GHSA-whgv-8cg3-7hcm |
CVE-2016-4423: Large username storage in session The attemptAuthentication function in `Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php` does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames. |
Affected by 2 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-hzwd-mq3r-qfcb | Uncontrolled Resource Consumption The Security component in Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750. |
CVE-2013-5958
GHSA-cr49-fx2v-9p57 |