symfony vulnerabilities (Ubuntu)
72 vulnerabilities.
-
symfonyUbuntu Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References 8.2 High -
symfonyUbuntu Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761) 5.3 Medium -
symfonyUbuntu Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control 6.3 Medium -
symfonyUbuntu Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063) 7.7 High -
symfonyUbuntu Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process 8.7 High -
symfonyUbuntu Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process 8.7 High -
symfonyUbuntu Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header 8.7 High -
symfonyUbuntu Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) 6.9 Medium -
symfonyUbuntu Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization 5.1 Medium -
symfonyUbuntu Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense 5.3 Medium -
symfonyUbuntu Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade 6.3 Medium -
symfonyUbuntu Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient 6.9 Medium -
symfonyUbuntu Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes 8.7 High -
symfonyUbuntu Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content 5.3 Medium -
symfonyUbuntu Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch 8.3 High -
symfonyUbuntu Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection 6.9 Medium -
symfonyUbuntu Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS 8.2 High -
symfonyUbuntu Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection 6.9 Medium -
symfonyUbuntu Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection 6.9 Medium -
symfonyUbuntu Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) 2.1 Low -
symfonyUbuntu Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex 8.7 High -
symfonyUbuntu Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") 8.7 High -
symfonyUbuntu Symfony: [Yaml] Harden the parser when handling untrusted input 8.2 High -
symfonyUbuntu Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener 8.3 High -
symfonyUbuntu Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] 8.3 High -
symfonyUbuntu Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay 7.6 High -
symfonyUbuntu Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix 6.3 Medium -
symfonyUbuntu Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering 2.0 Low -
symfonyUbuntu Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true 8.7 High -
symfonyUbuntu Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names 6.3 Medium -
symfonyUbuntu Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims 8.8 High -
symfonyUbuntu Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address 8.7 High -
symfonyUbuntu Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address 6.3 Medium -
symfonyUbuntu Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification 2.3 Low -
symfonyUbuntu Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing 2.3 Low -
symfonyUbuntu Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection 2.3 Low -
symfonyUbuntu Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator 9.1 Critical -
symfonyUbuntu [Unknown description] No score -
symfonyUbuntu Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass 7.3 High -
symfonyUbuntu Symphony has an Authentication Bypass via RememberMe 7.5 High -
symfonyUbuntu Open redirect via browser-sanitized URLs in symfony/http-foundation 3.1 Low -
symfonyUbuntu Incorrect response from Validator when input ends with `\n` in symfony/validator 3.1 Low -
symfonyUbuntu Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client 3.1 Low -
symfonyUbuntu Security::login does not take into account custom user_checker in symfony/security-bundle 3.1 Low -
symfonyUbuntu Ability to change environment from query in symfony/runtime 7.3 High -
symfonyUbuntu Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters 6.1 Medium -
symfonyUbuntu Symfony storing cookie headers in HttpCache 5.9 Medium -
symfonyUbuntu Symfony vulnerable to Session Fixation of CSRF tokens 6.3 Medium -
symfonyUbuntu CSV Injection in Symfony 6.5 Medium -
symfonyUbuntu Prevent user enumeration using Guard or the new Authenticator-based Security 5.3 Medium - Show olderLoading…