Search for packages
| purl | pkg:deb/debian/symfony@3.4.12%2Bdfsg-1?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-2hua-7wbd-tqbx | Insufficient Session Expiration The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources. |
CVE-2018-11386
GHSA-r2rq-3h56-fqm4 |
| VCID-556v-rym3-6yax | Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the `invalidate_session` option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation. |
CVE-2018-11406
GHSA-g4g7-q726-v5hg |
| VCID-71vh-7wte-kfcx | Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker. |
CVE-2018-11385
GHSA-g4rg-rw65-8hfg |
| VCID-c3p1-j3qy-33cx | Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues). |
CVE-2018-12040
|
| VCID-dqaj-qmbd-cya1 | Improper Authentication An issue was discovered in the Ldap component in Symfony. It allows remote attackers to bypass authentication by logging in with a `null` password and valid username, which triggers an unauthenticated bind. |
CVE-2018-11407
GHSA-35c5-28pg-2qg4 |
| VCID-k8zb-z9em-vqgm | URL Redirection to Untrusted Site (Open Redirect) The security handlers in the Security component in Symfony have an Open redirect vulnerability when `security.http_utils` is inlined by a container. |
CVE-2018-11408
GHSA-7hwc-2cq4-6x2w |