Vulnerabilities > Sensiolabs

DATE CVE VULNERABILITY TITLE RISK
2014-12-27 CVE-2013-5958 Resource Management Errors vulnerability in Sensiolabs Symfony
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.
network
low complexity
sensiolabs CWE-399
5.0
2014-06-02 CVE-2013-1397 Code Injection vulnerability in Sensiolabs Symfony
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
network
low complexity
sensiolabs CWE-94
7.5
2014-06-02 CVE-2013-1348 Code Injection vulnerability in Sensiolabs Symfony
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.
network
low complexity
sensiolabs CWE-94
7.5
2012-12-27 CVE-2012-6432 Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony
Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
6.8
2012-12-27 CVE-2012-6431 Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony
Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
network
low complexity
sensiolabs CWE-264
6.4
2012-12-18 CVE-2012-5574 Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony
lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request.
network
low complexity
sensiolabs CWE-264
5.0
2012-06-07 CVE-2012-2667 Unspecified vulnerability in Sensiolabs Symfony
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
network
sensiolabs
4.3