Search for packages
| purl | pkg:composer/symfony/http-foundation@4.0.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3uj4-tk9q-6bhc
Aliases: CVE-2018-11386 GHSA-r2rq-3h56-fqm4 |
Symfony DoS An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources. |
Affected by 0 other vulnerabilities. |
|
VCID-718a-9ndd-syex
Aliases: CVE-2019-18888 GHSA-xhh6-956q-4q69 |
Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x). |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-bnwq-cmt5-7qcr
Aliases: CVE-2019-10913 GHSA-x92h-wmg2-6hp7 |
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zbme-ygft-4qht
Aliases: CVE-2018-14773 GHSA-8wgj-6wx8-h5hq |
access restriction bypass |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||