Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

sylius/resource-bundle

4 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 1 high, 2 medium
Registry
Packagist

Advisories 4

  • Remote Code Execution in SyliusResourceBundle

    Affected: from 1.4.0, fixed in 1.4.7; from 1.5.0, fixed in 1.5.2; from 1.6.0, fixed in 1.6.4; from 1.0.0, fixed in 1.3.14.

  • CVE-2020-15146Critical 9.6

    Remote Code Execution in SyliusResourceBundle

    Affected: from 1.4.0, fixed in 1.4.7; from 1.5.0, fixed in 1.5.2; from 1.6.0, fixed in 1.6.4; from 1.0.0, fixed in 1.3.14.

  • CVE-2020-5218Medium 4.4

    Ability in Sylius to switch channels via GET parameter enabled in production environments

    Affected: from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1; from 1.6.0, fixed in 1.6.3; from 1.0.0, fixed in 1.3.13.

  • CVE-2020-5220Medium 4.4

    Ability to expose data in Sylius by using an unintended serialisation group

    Affected: from 1.4.0, fixed in 1.4.6; from 1.5.0, fixed in 1.5.1; from 1.6.0, fixed in 1.6.3; from 1.0.0, fixed in 1.3.13.