Search for packages
| purl | pkg:deb/debian/cakephp@1.3.2-1.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-251n-1k53-57dd
Aliases: CVE-2015-8379 GHSA-556q-h4vr-pgh2 |
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. |
Affected by 0 other vulnerabilities. |
|
VCID-3cx6-dpsf-xkhw
Aliases: CVE-2016-4793 GHSA-j8p3-8m69-2hqq |
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-5egb-33db-tkfn | The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files. |
CVE-2010-4335
GHSA-g2vx-8v47-4vhh |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-13T12:45:47.642416+00:00 | Debian Oval Importer | Fixing | VCID-5egb-33db-tkfn | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |
| 2026-06-13T04:49:41.499719+00:00 | Debian Oval Importer | Affected by | VCID-3cx6-dpsf-xkhw | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |
| 2026-06-13T04:41:46.523549+00:00 | Debian Oval Importer | Affected by | VCID-251n-1k53-57dd | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |