VulnerableCode Package Details - pkg:composer/symfony/http-foundation@2.0.0

Search for packages

Advisory	Summary	Fixed in package version
GHSA-22pv-7v9j-hqxp Aliases: CVE-2013-4752	Symfony Host Header Injection vulnerability in the HttpFoundation component Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and …	2.0.24 Vulnerable
GHSA-83c3-qx27-2rwr Aliases: CVE-2012-6431	Symfony Allows URI Restrictions Bypass Via Double-Encoded String On the Symfony 2.0.x version, there's a security issue that allows access …	2.0.19 Vulnerable
GHSA-xhh6-956q-4q69 Aliases: CVE-2019-18888	Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …	2.8.52 Vulnerable
GHSA-p684-f7fh-jv2j Aliases: CVE-2015-2309	Symfony has unsafe methods in the Request class All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the …	2.3.27 Vulnerable
GHSA-vfm6-r2gc-pwww	Symfony2 security issue when the trust proxy mode is enabled An application is vulnerable if it uses the client IP …	2.0.19 Vulnerable
GHSA-h7v2-2qwg-h829 Aliases: CVE-2014-6061	Symfony has a security issue when parsing the Authorization header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of …	2.3.19 Vulnerable
GHSA-v77v-x634-9m56 Aliases: CVE-2014-5244	Symfony vulnerable to denial of service via a malicious HTTP Host header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X …	2.3.19 Vulnerable
CVE-2018-11386	Insufficient Session Expiration The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2014-5244	Uncontrolled Resource Consumption Denial of service with a malicious HTTP Host header.	2.4.9 Vulnerable 2.5.4 Vulnerable
CVE-2018-14773	URL Rewrite vulnerability An issue in Symfony arises from support for a (legacy) IIS header that lets users override the …	2.8.44 Vulnerable 3.4.14 Vulnerable 4.0.14 Vulnerable 4.1.3 Vulnerable
GMS-2012-9	Information Exposure `Request::getClientIp()` gives access to client IP when the trust proxy mode is enabled.	2.0.19 Vulnerable 2.1.4 Vulnerable
CVE-2014-6061	Improper Authorization Security issue when parsing the Authorization header.	2.4.9 Vulnerable 2.5.4 Vulnerable

Advisory

Summary

Fixed in package version

GHSA-22pv-7v9j-hqxp
Aliases:
CVE-2013-4752

Symfony Host Header Injection vulnerability in the HttpFoundation component Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and …

2.0.24
Vulnerable

GHSA-83c3-qx27-2rwr
Aliases:
CVE-2012-6431

Symfony Allows URI Restrictions Bypass Via Double-Encoded String On the Symfony 2.0.x version, there's a security issue that allows access …

2.0.19
Vulnerable

GHSA-xhh6-956q-4q69
Aliases:
CVE-2019-18888

Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …

2.8.52
Vulnerable

GHSA-p684-f7fh-jv2j
Aliases:
CVE-2015-2309

Symfony has unsafe methods in the Request class All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the …

2.3.27
Vulnerable

GHSA-vfm6-r2gc-pwww

Symfony2 security issue when the trust proxy mode is enabled An application is vulnerable if it uses the client IP …

2.0.19
Vulnerable

GHSA-h7v2-2qwg-h829
Aliases:
CVE-2014-6061

Symfony has a security issue when parsing the Authorization header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of …

2.3.19
Vulnerable

GHSA-v77v-x634-9m56
Aliases:
CVE-2014-5244

Symfony vulnerable to denial of service via a malicious HTTP Host header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X …

2.3.19
Vulnerable

CVE-2018-11386

Insufficient Session Expiration The `PDOSessionHandler` class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted …

2.8.41
Vulnerable

3.4.11
Vulnerable

4.0.11
Vulnerable

CVE-2014-5244

Uncontrolled Resource Consumption Denial of service with a malicious HTTP Host header.

2.4.9
Vulnerable

2.5.4
Vulnerable

CVE-2018-14773

URL Rewrite vulnerability An issue in Symfony arises from support for a (legacy) IIS header that lets users override the …

2.8.44
Vulnerable

3.4.14
Vulnerable

4.0.14
Vulnerable

4.1.3
Vulnerable

GMS-2012-9

Information Exposure `Request::getClientIp()` gives access to client IP when the trust proxy mode is enabled.

2.0.19
Vulnerable

2.1.4
Vulnerable

CVE-2014-6061

Improper Authorization Security issue when parsing the Authorization header.

2.4.9
Vulnerable

2.5.4
Vulnerable

purl	pkg:composer/symfony/http-foundation@2.0.0
Tags	Ghost

Next non-vulnerable version	5.4.54
Latest non-vulnerable version	8.1.7
Risk score	3.4