# symfony/security-core (Packagist) vulnerabilities

5 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/symfony/security-core

## Advisories (5)

### [CVE-2021-21424](https://cve.now/CVE-2021-21424): Prevent user enumeration using Guard or the new Authenticator-based Security

- Severity: Medium 5.3
- Published: May 13, 2021
- Affected: from 2.8.0, fixed in 3.4.48; from 4.0.0, fixed in 4.4.23; from 5.0.0, fixed in 5.2.8.

### [CVE-2017-11365](https://cve.now/CVE-2017-11365): Certain Symfony products are affected by: Incorrect Access Control.

- Severity: Unrated
- Published: May 23, 2019
- Affected: from 2.7.30, fixed in 2.7.32; from 2.8.23, fixed in 2.8.25; from 3.2.10, fixed in 3.2.12; from 3.3.3, fixed in 3.3.5.

### [CVE-2018-11407](https://cve.now/CVE-2018-11407): An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before…

- Severity: Unrated
- Published: Jun 13, 2018
- Affected: from 2.8.0, fixed in 2.8.37; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.7; from 4.0.0, fixed in 4.0.7.

### [CVE-2016-2403](https://cve.now/CVE-2016-2403): Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid…

- Severity: Unrated
- Published: Feb 7, 2017
- Affected: from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

### [CVE-2016-1902](https://cve.now/CVE-2016-1902): The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly…

- Severity: Unrated
- Published: Jun 1, 2016
- Affected: from 2.4.0, fixed in 2.6.13; from 2.7.0, fixed in 2.7.9.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/symfony/security-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.