Vulnerabilities > Sensiolabs > Symfony > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-06-24 | CVE-2015-2308 | Code Injection vulnerability in Sensiolabs Symfony Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element. | 6.8 |
| 2015-06-02 | CVE-2015-4050 | Improper Access Control vulnerability in Sensiolabs Symfony FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment. | 4.3 |
| 2014-12-27 | CVE-2013-5958 | Resource Management Errors vulnerability in Sensiolabs Symfony The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750. | 5.0 |
| 2012-12-27 | CVE-2012-6432 | Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring. | 6.8 |
| 2012-12-27 | CVE-2012-6431 | Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string. | 6.4 |
| 2012-12-18 | CVE-2012-5574 | Permissions, Privileges, and Access Controls vulnerability in Sensiolabs Symfony lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote attackers to read arbitrary files via a crafted upload request. | 5.0 |
| 2012-06-07 | CVE-2012-2667 | Unspecified vulnerability in Sensiolabs Symfony Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes." network sensiolabs | 4.3 |