Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/security-core

5 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 medium
Registry
Packagist

Advisories 5

  • CVE-2021-21424Medium 5.3

    Prevent user enumeration using Guard or the new Authenticator-based Security

    Affected: from 2.8.0, fixed in 3.4.48; from 4.0.0, fixed in 4.4.23; from 5.0.0, fixed in 5.2.8.

  • Certain Symfony products are affected by: Incorrect Access Control.

    Affected: from 2.7.30, fixed in 2.7.32; from 2.8.23, fixed in 2.8.25; from 3.2.10, fixed in 3.2.12; from 3.3.3, fixed in 3.3.5.

  • An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before…

    Affected: from 2.8.0, fixed in 2.8.37; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.7; from 4.0.0, fixed in 4.0.7.

  • Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid…

    Affected: from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

  • The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly…

    Affected: from 2.4.0, fixed in 2.6.13; from 2.7.0, fixed in 2.7.9.