# symfony/security (Packagist) vulnerabilities 17 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/symfony/security ## Advisories (17) ### [CVE-2021-21424](https://cve.now/CVE-2021-21424): Prevent user enumeration using Guard or the new Authenticator-based Security - Severity: Medium 5.3 - Published: May 13, 2021 - Affected: from 5.0.0, fixed in 5.2.8; from 2.8.0, fixed in 3.4.49; from 4.0.0, fixed in 4.4.24. ### [CVE-2020-5275](https://cve.now/CVE-2020-5275): Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http - Severity: High 7.6 - Published: Mar 30, 2020 - Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7. ### [CVE-2017-11365](https://cve.now/CVE-2017-11365): Certain Symfony products are affected by: Incorrect Access Control. - Severity: Unrated - Published: May 23, 2019 - Affected: from 2.7.30, fixed in 2.7.32; from 2.8.23, fixed in 2.8.25; from 3.2.10, fixed in 3.2.12; from 3.3.3, fixed in 3.3.5. ### [CVE-2019-10911](https://cve.now/CVE-2019-10911): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow… - Severity: Unrated - Published: May 16, 2019 - Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7. ### [CVE-2018-19790](https://cve.now/CVE-2018-19790): An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before… - Severity: Unrated - Published: Dec 18, 2018 - Affected: from 2.7.38, fixed in 2.7.50; from 2.8.0, fixed in 2.8.49; from 3.0.0, fixed in 3.4.19; from 4.0.0, fixed in 4.0.15; from 4.1.0, fixed in 4.1.9; from 4.2.0, fixed in 4.2.1. ### [CVE-2017-16653](https://cve.now/CVE-2017-16653): An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. - Severity: Unrated - Published: Aug 6, 2018 - Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.0.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13. ### [CVE-2018-11407](https://cve.now/CVE-2018-11407): An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before… - Severity: Unrated - Published: Jun 13, 2018 - Affected: from 2.8.0, fixed in 2.8.37; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.7; from 4.0.0, fixed in 4.0.7. ### [CVE-2018-11406](https://cve.now/CVE-2018-11406): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before… - Severity: Unrated - Published: Jun 13, 2018 - Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11. ### [CVE-2018-11385](https://cve.now/CVE-2018-11385): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before… - Severity: Unrated - Published: Jun 13, 2018 - Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11. ### [CVE-2017-16652](https://cve.now/CVE-2017-16652): An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. - Severity: Unrated - Published: Jun 13, 2018 - Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.2.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13. ### [CVE-2016-2403](https://cve.now/CVE-2016-2403): Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid… - Severity: Unrated - Published: Feb 7, 2017 - Affected: from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6. ### [CVE-2016-4423](https://cve.now/CVE-2016-4423): The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before… - Severity: Unrated - Published: Jun 1, 2016 - Affected: from 2.3.0, fixed in 2.3.41; from 2.4.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6. ### [CVE-2016-1902](https://cve.now/CVE-2016-1902): The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly… - Severity: Unrated - Published: Jun 1, 2016 - Affected: from 2.3.0, fixed in 2.3.37; from 2.4.0, fixed in 2.6.13; from 2.7.0, fixed in 2.7.9. ### [CVE-2015-8125](https://cve.now/CVE-2015-8125): Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a… - Severity: Unrated - Published: Dec 7, 2015 - Affected: from 2.3.0, fixed in 2.3.35; from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7. ### [CVE-2015-8124](https://cve.now/CVE-2015-8124): Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before… - Severity: Unrated - Published: Dec 7, 2015 - Affected: from 2.3.0, fixed in 2.3.35; from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7. ### [CVE-2013-5958](https://cve.now/CVE-2013-5958): The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote… - Severity: Unrated - Published: Dec 27, 2014 - Affected: from 2.0.0, fixed in 2.0.25; from 2.1.0, fixed in 2.1.13; from 2.2.0, fixed in 2.2.9; from 2.3.0, fixed in 2.3.6. ### [CVE-2012-6431](https://cve.now/CVE-2012-6431): Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote… - Severity: Unrated - Published: Dec 27, 2012 - Affected: from 2.0.0, fixed in 2.0.19. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/symfony/security Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.