| GHSA-q2gc-gg3x-7942 | ALTO7.5 | Symfony XML Entity Expansion security vulnerability | 30/05/2024 |
| GHSA-mmcv-fvq8-r9x3 | CRÍTICO9.8 | Symfony XML decoding attack vector through external entities | 30/05/2024 |
| GHSA-7mx2-7q8p-pgmw | MÉDIO6.5 | Symfony may allow a user to switch to using another user's identity | 30/05/2024 |
| CVE-2014-5245 | ALTO7.5 | Symfony allows direct access of ESI URLs behind a trusted proxy | 30/05/2024 |
| CVE-2015-2309 | MÉDIO5.3 | Symfony has unsafe methods in the Request class | 30/05/2024 |
| CVE-2014-6061 | MÉDIO5.3 | Symfony has a security issue when parsing the Authorization header | 30/05/2024 |
| CVE-2014-5244 | ALTO7.5 | Symfony vulnerable to denial of service via a malicious HTTP Host header | 30/05/2024 |
| GHSA-vfm6-r2gc-pwww | MÉDIO | Symfony2 security issue when the trust proxy mode is enabled | 30/05/2024 |
| CVE-2014-4931 | ALTO7.5 | Code injection in the way Symfony implements translation caching in FrameworkBundle | 30/05/2024 |
| CVE-2023-46735 | MÉDIO6.1 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in | 10/11/2023 |
| CVE-2023-46734 | MÉDIO6.1 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4. | 10/11/2023 |
| CVE-2023-46733 | MÉDIO6.5 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means | 10/11/2023 |
| CVE-2022-24895 | ALTO8.8 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers t | 03/02/2023 |
| CVE-2022-24894 | ALTO8.8 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set | 03/02/2023 |
| CVE-2021-41270 | MÉDIO6.5 | Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony | 24/11/2021 |
| CVE-2021-41268 | ALTO8.8 | Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access | 24/11/2021 |
| CVE-2021-41267 | MÉDIO6.5 | Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for | 24/11/2021 |
| CVE-2021-32693 | ALTO8.8 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available | 17/06/2021 |
| GHSA-g2qj-pmxm-9f8f | BAIXO | User enumeration in authentication mechanisms | 17/05/2021 |
| CVE-2021-21424 | MÉDIO5.3 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s | 13/05/2021 |