VulnerableCode Package Details - pkg:composer/symfony/symfony@2.0.0

Vulnerabilities affecting this package (39)

Advisory	Summary	Fixed in package version
GHSA-3rg7-wf37-54rm Aliases: CVE-2025-64500	Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass ### Description The `Request` class improperly interprets some `PATH_INFO` …	5.4.50 Vulnerable
GHSA-89cp-fvcc-hxh7 Aliases: CVE-2012-6432	Symfony Access Control Vulnerability Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, …	2.0.20 Vulnerable
GHSA-22pv-7v9j-hqxp Aliases: CVE-2013-4752	Symfony Host Header Injection vulnerability in the HttpFoundation component Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and …	2.0.24 Vulnerable
GHSA-7w53-hfpw-rg3g Aliases: CVE-2013-1397	Symfony Arbitrary PHP code Execution Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP …	2.0.22 Vulnerable
GHSA-2r5h-6r7v-5m7c Aliases: CVE-2013-1348	Symphony Vulnerable to PHP Code Injection via YAML Parsing The `Yaml::parse` function in Symfony 2.0.x before 2.0.22 remote attackers to …	2.0.22 Vulnerable
GHSA-cr49-fx2v-9p57 Aliases: CVE-2013-5958	Symfony Denial of Service Via Long Password Hashing The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x …	2.0.25 Vulnerable
GHSA-q8j7-fjh7-25v5 Aliases: CVE-2013-4751	Symfony collectionCascaded and collectionCascadedDeeply fields security bypass When using the Validator component, if `Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache` is enabled (or any other cache …	2.0.24 Vulnerable
GHSA-5c58-w9xc-qcj9 Aliases: CVE-2015-2308	Symfony Vulnerable to PHP Eval Injection Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using …	2.3.27 Vulnerable
GHSA-83c3-qx27-2rwr Aliases: CVE-2012-6431	Symfony Allows URI Restrictions Bypass Via Double-Encoded String On the Symfony 2.0.x version, there's a security issue that allows access …	2.0.19 Vulnerable
GHSA-xhh6-956q-4q69 Aliases: CVE-2019-18888	Argument injection in a MimeTypeGuesser in Symfony An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 …	2.8.52 Vulnerable
GHSA-q2gc-gg3x-7942	Symfony XML Entity Expansion security vulnerability Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I …	2.0.17 Vulnerable
GHSA-v35g-4rrw-h4fw Aliases: CVE-2014-6072	Symfony Cross-Site Request Forgery vulnerability in the Web Profiler All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the …	2.3.19 Vulnerable
GHSA-p684-f7fh-jv2j Aliases: CVE-2015-2309	Symfony has unsafe methods in the Request class All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the …	2.3.27 Vulnerable
GHSA-7mx2-7q8p-pgmw	Symfony may allow a user to switch to using another user's identity Symfony 2.0.6 has just been released. It addresses …	2.0.6 Vulnerable
GHSA-vfm6-r2gc-pwww	Symfony2 security issue when the trust proxy mode is enabled An application is vulnerable if it uses the client IP …	2.0.19 Vulnerable
GHSA-hx53-jchx-cr52	Symfony2 improper IP based access control Damien Tournoud, from the Drupal security team, contacted us two days ago about a …	2.0.19 Vulnerable
GHSA-mmcv-fvq8-r9x3	Symfony XML decoding attack vector through external entities The XMLEncoder component of Symfony 2.0.x fails to disable external entities when …	2.0.11 Vulnerable
GHSA-wfv7-5x33-v22h Aliases: CVE-2014-4931	Code injection in the way Symfony implements translation caching in FrameworkBundle When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious …	2.3.19 Vulnerable
GHSA-wvjv-p5rr-mmqm Aliases: CVE-2014-5245	Symfony allows direct access of ESI URLs behind a trusted proxy All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the …	2.3.19 Vulnerable
GHSA-h7v2-2qwg-h829 Aliases: CVE-2014-6061	Symfony has a security issue when parsing the Authorization header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of …	2.3.19 Vulnerable
GHSA-v77v-x634-9m56 Aliases: CVE-2014-5244	Symfony vulnerable to denial of service via a malicious HTTP Host header All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X …	2.3.19 Vulnerable
GHSA-q847-2q57-wmr3 Aliases: CVE-2023-46734	Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters ### Description Some Twig filters in CodeExtension use "is_safe=html" but don't actually …	4.4.51 Vulnerable
GHSA-3gv2-29qc-v67m Aliases: CVE-2022-24895	Symfony vulnerable to Session Fixation of CSRF tokens Description ----------- When authenticating users Symfony by default regenerates the session ID …	4.4.50 Vulnerable
GHSA-h7vf-5wrv-9fhv Aliases: CVE-2022-24894	Symfony storing cookie headers in HttpCache Description ----------- The Symfony HTTP cache system acts as a reverse proxy: it caches …	4.4.50 Vulnerable
CVE-2018-11386	Insufficient Session Expiration An issue was discovered in the `HttpFoundation` component in Symfony. The `PDOSessionHandler` class allows storing sessions on …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2014-5244	Uncontrolled Resource Consumption Denial of service with a malicious HTTP Host header.	2.4.9 Vulnerable 2.5.4 Vulnerable
CVE-2018-14773	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') An issue was discovered in Http Foundation in Symfony. It arises from …	4.1.3 Vulnerable 2.8.44 Vulnerable 3.4.14 Vulnerable 4.0.14 Vulnerable
GMS-2012-12	Improper Restriction of XML External Entity Reference XML decoding attack vector through external entities.	2.0.11 Vulnerable
GMS-2011-5	Improper Privilege Management Vulnerability in the `EntityUserProvider` as provided in the Doctrine bridge.	2.0.6 Vulnerable
GMS-2012-13	Improper Restriction of XML External Entity Reference Security fixes related to the way XML is handled.	2.0.17 Vulnerable
CVE-2012-6432	Code Injection Symfony, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving …	2.0.20 Vulnerable 2.1.5 Vulnerable
CVE-2014-5245	Information Disclosure Direct access of ESI URLs behind a trusted proxy	2.4.9 Vulnerable 2.5.4 Vulnerable
GMS-2012-14	Information Exposure Request::getClientIp() when the trust proxy mode is enabled.	2.0.19 Vulnerable 2.1.4 Vulnerable
CVE-2014-4931	Code Injection Code injection in the way Symfony implements translation caching in `FrameworkBundle`.	2.4.9 Vulnerable 2.5.4 Vulnerable
CVE-2014-6072	Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) CSRF vulnerability in the Web Profiler.	2.4.9 Vulnerable 2.5.4 Vulnerable
CVE-2018-11406	Cross-Site Request Forgery (CSRF) By default, a user's session is invalidated when the user is logged out. This behavior can …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2018-11385	Session Fixation A session fixation vulnerability within the `Guard` login feature may allow an attacker to impersonate a victim towards …	2.8.41 Vulnerable 3.4.11 Vulnerable 4.0.11 Vulnerable
CVE-2014-6061	Improper Privilege Management Security issue when parsing the Authorization header.	2.4.9 Vulnerable 2.5.4 Vulnerable
GHSA-2v3c-qxhr-7vpv Aliases: CVE-2026-109413	Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process ### Description `Yaml\Parser::lexInlineStructure()` recursed through …	5.4.54 Not vulnerable

purl	pkg:composer/symfony/symfony@2.0.0
Tags	Ghost

Next non-vulnerable version	5.4.54
Latest non-vulnerable version	8.1.7
Risk score	4.4