Use of Insufficiently Random Values in yiisoft/yii2-dev

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-3689 · ADVISORY
• yiisoft/yii2 commit 13f27e4 · WEB
• yiisoft/yii2 · PACKAGE
• huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f · WEB

Weitere Schwachstellen in yiisoft/yii2-dev

• CVE-2025-2689KRITISCH 9.8A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIt…
• CVE-2021-3692MITTEL 5.3yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
• CVE-2018-8074HOCH 8.1Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunctio…
• CVE-2018-7269KRITISCH 9.8The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection atta…
• CVE-2018-6009HOCH 8.8In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.