Debian Symfony vulnerabilities

CVE-2020-5274 [MEDIUM] CVE-2020-5274: symfony - In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception wer... In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patc

CVE-2018-11408 [MEDIUM] CVE-2018-11408: symfony - The security handlers in the Security component in Symfony in 2.7.x before 2.7.4... The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652. Scope: local bookworm: resolved (fi

CVE-2018-19790 [MEDIUM] CVE-2018-19790: symfony - An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8... An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login. S

CVE-2017-16652 [MEDIUM] CVE-2017-16652: symfony - An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2... An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external

CVE-2019-10909 [MEDIUM] CVE-2019-10909: symfony - In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1... In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. Scope: local bookworm: resolved (fixed in 3.4.22+dfsg-2) bullseye: resolved (fixed in 3.4.22+dfsg-2) forky: resolved (fixed

CVE-2018-12040 [MEDIUM] CVE-2018-12040: symfony - Reflected Cross-site scripting (XSS) vulnerability in the web profiler in Sensio... Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI. NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues

CVE-2024-50342 [LOW] CVE-2024-50342: symfony - symfony/http-client is a module for the Symphony PHP framework which provides po... symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetwo

CVE-2007-2383 [MEDIUM] CVE-2007-2383: asterisk - The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using Java... The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijack

CVE-2020-5255 [LOW] CVE-2020-5255: symfony - In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a... In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by oth

CVE-2024-50341 [LOW] CVE-2024-50341: symfony - symfony/security-bundle is a module for the Symphony PHP framework which provide... symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Securi

CVE-2024-50343 [LOW] CVE-2024-50343: symfony - symfony/validator is a module for the Symphony PHP framework which provides tool... symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to u

CVE-2015-2309 CVE-2015-2309: symfony bookworm: resolved (fixed in 2.3.21+dfsg-4) bullseye: resolved (fixed in 2.3.21+dfsg-4) forky: resolved (fixed in 2.3.21+dfsg-4) sid: resolved (fixed in 2.3.21+dfsg-4) trixie: resolved (fixed in 2.3.21+dfsg-4)