Vulnerabilities > Sensiolabs

DATE CVE VULNERABILITY TITLE RISK
2020-03-30 CVE-2020-5275 Incorrect Authorization vulnerability in Sensiolabs Symfony
In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy.
network
low complexity
sensiolabs CWE-863
8.1
2020-03-30 CVE-2020-5274 Information Exposure Through an Error Message vulnerability in Sensiolabs Symfony
In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace.
network
low complexity
sensiolabs CWE-209
5.4
2020-03-30 CVE-2020-5255 Improper Input Validation vulnerability in Sensiolabs Symfony
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header.
network
low complexity
sensiolabs CWE-20
4.3
2020-01-02 CVE-2013-4752 Cross-site Scripting vulnerability in multiple products
Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component.
network
low complexity
sensiolabs fedoraproject CWE-79
6.1
2019-11-21 CVE-2019-18889 Code Injection vulnerability in multiple products
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.
network
low complexity
sensiolabs fedoraproject CWE-94
critical
9.8
2019-11-21 CVE-2019-18888 Argument Injection or Modification vulnerability in multiple products
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.
network
low complexity
sensiolabs fedoraproject CWE-88
7.5
2019-11-21 CVE-2019-18887 Information Exposure Through Discrepancy vulnerability in multiple products
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7.
network
high complexity
sensiolabs fedoraproject CWE-203
8.1
2019-11-21 CVE-2019-11325 Improper Encoding or Escaping of Output vulnerability in Sensiolabs Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8.
network
low complexity
sensiolabs CWE-116
critical
9.8
2019-11-21 CVE-2019-18886 Information Exposure Through Discrepancy vulnerability in Sensiolabs Symfony
An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7.
network
low complexity
sensiolabs CWE-203
5.3
2019-11-01 CVE-2013-4751 Improper Input Validation vulnerability in multiple products
php-symfony2-Validator has loss of information during serialization
network
low complexity
sensiolabs fedoraproject redhat CWE-20
8.1