Package Instance

Information disclosure
Remote attackers can obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

Use of Insufficiently Random Values
yii2 is vulnerable to use of predictable algorithm in a random number generator

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

Deserialization of Untrusted Data
Yii 2 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input.

Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Yii Framework allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6

Remote code execution
Redis extension of Yii 2 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Class `yii\web\ViewAction` allowed to include arbitrary files that end with `.php`.

Origin Validation Error
Yii actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.

Code Injection
Yii allows remote attackers to inject unintended search conditions.

yiisoft Yii2 Deserialization of Untrusted Data
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CSRF vulnerability in switchIdentiy
The `switchIdentity()` function in `web/User.php` did not regenerate the CSRF token upon a change of identity.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function.