Use of Insufficiently Random Values in yiisoft/yii2-dev

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2021-3689 · ADVISORY
• yiisoft/yii2 commit 13f27e4 · WEB
• yiisoft/yii2 · PACKAGE
• huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f · WEB

yiisoft/yii2-dev のその他の脆弱性

• CVE-2025-2689緊急 9.8A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIt…
• CVE-2021-3692中 5.3yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
• CVE-2018-8074高 8.1Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunctio…
• CVE-2018-7269緊急 9.8The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection atta…
• CVE-2018-6009高 8.8In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity.