Search for packages
| purl | pkg:composer/friendsofsymfony/user-bundle@1.2.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-cp9j-3948-mud8
Aliases: GMS-2014-38 |
Insufficient Entropy Entropy is lost in the `TokenGenerator`. |
Affected by 2 other vulnerabilities. |
|
VCID-ky5a-sata-5yf6
Aliases: CVE-2013-5750 GHSA-9mpf-g3fc-9rgv |
Uncontrolled Resource Consumption The login form in the FriendsOfSymfony FOSUserBundle bundle for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation. |
Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-yyyq-za39-r3hh
Aliases: GHSA-pjx8-984p-7p3x |
FOSUserBundle Entropy is lost in the TokenGenerator Because of the usage of base_convert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically safe. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-98wp-9e1h-yfgg | Improper Authentication user-bundle contains a security issue where the session could be hijacked. |
GMS-2012-7
|
| VCID-fkq5-7t4p-jbdk | FOSUserBundle Session Hijacking Vulnerability Versions of FOSUserBundle from 1.2.x to 1.2.4 have been found to contain a security vulnerability related to session hijacking. This issue has been addressed in version 1.2.4, and users are strongly advised to upgrade to the latest version to prevent potential session-related security risks. |
GHSA-6mjq-9x4w-m3w9
|