Search for packages
| purl | pkg:composer/symfony/security@2.4.0-BETA2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-ef86-hqv4-6kaz
Aliases: CVE-2018-11406 GHSA-g4g7-q726-v5hg |
Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation. |
Affected by 5 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-vyug-krcw-jyef
Aliases: CVE-2018-11385 GHSA-g4rg-rw65-8hfg |
Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker. |
Affected by 5 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-04T20:13:15.750054+00:00 | GitLab Importer | Affected by | VCID-vyug-krcw-jyef | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security/CVE-2018-11385.yml | 38.6.0 |
| 2026-06-04T20:13:15.042286+00:00 | GitLab Importer | Affected by | VCID-ef86-hqv4-6kaz | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/symfony/security/CVE-2018-11406.yml | 38.6.0 |