Search for packages
| purl | pkg:composer/cakephp/cakephp@2.5.0-beta |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-251n-1k53-57dd
Aliases: CVE-2015-8379 GHSA-556q-h4vr-pgh2 |
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. |
Affected by 3 other vulnerabilities. |
|
VCID-3cx6-dpsf-xkhw
Aliases: CVE-2016-4793 GHSA-j8p3-8m69-2hqq |
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-74cw-ufme-5yfh
Aliases: CVE-2020-15400 GHSA-j33j-fg2g-mcv2 |
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-pndg-eaey-2ydk
Aliases: GMS-2015-17 |
Potential direct access to prefixed actions Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters. If your authorization depends on the presence of the prefix routing key you should upgrade as soon as possible. |
Affected by 7 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-ufhs-run3-kqag
Aliases: GMS-2015-18 |
Unreliable data validation There's a flow in Validation::compare() and Validation::range() that makes possible to pass validation criteria using crafted data. |
Affected by 7 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-yrzx-r3q3-43ej
Aliases: GMS-2015-41 |
Unsafe view template filenames result in a Remote File Inclusion vulnerability. |
Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||