DO NOT PUBLISH SECURITY REPORTS PUBLICLY.
If you found any issues that might have security implications, please send a report to security[at]symfony.com
The full Security Policy is described in the official documentation.
Security: symfony/symfony
Security
SECURITY.md
-
Authentication Bypass via persisted RememberMe cookieGHSA-cg23-qf8f-62rr published
Nov 13, 2024 by nicolas-grekasHigh -
Command execution hijack on Windows with Process classGHSA-qq5c-677p-737q published
Nov 6, 2024 by nicolas-grekasLow -
Open redirect via browser-sanitized URLsGHSA-mrqx-rp3w-jpjp published
Nov 6, 2024 by nicolas-grekasLow -
Incorrect response from Validator when input ends with `\n`GHSA-g3rh-rrhp-jhh9 published
Nov 6, 2024 by nicolas-grekasLow -
Security::login does not take into account custom user_checkerGHSA-jxgr-3v7q-3w9v published
Nov 6, 2024 by fabpotLow -
Internal address and port enumeration allowed by NoPrivateNetworkHttpClientGHSA-9c3x-r3wp-mgxm published
Nov 6, 2024 by fabpotLow -
Ability to change environment from queryGHSA-x8vp-gf4q-mw5j published
Nov 6, 2024 by fabpotHigh -
Potential XSS in WebhookControllerGHSA-72x2-5c85-6wmr published
Nov 10, 2023 by nicolas-grekasModerate -
Potential XSS vulnerabilities in CodeExtension filtersGHSA-q847-2q57-wmr3 published
Nov 10, 2023 by nicolas-grekasLow -
Possible session fixationGHSA-m2wj-r6g3-fxfx published
Nov 10, 2023 by nicolas-grekasModerate
Learn more about advisories related to symfony/symfony in the GitHub Advisory Database