DO NOT PUBLISH SECURITY REPORTS PUBLICLY.
If you found any issues that might have security implications, please send a report to security[at]symfony.com
The full Security Policy is described in the official documentation.
Security: symfony/symfony
Security
SECURITY.md
-
Potential XSS in WebhookControllerGHSA-72x2-5c85-6wmr published
Nov 10, 2023 by nicolas-grekasModerate -
Potential XSS vulnerabilities in CodeExtension filtersGHSA-q847-2q57-wmr3 published
Nov 10, 2023 by nicolas-grekasLow -
Possible session fixationGHSA-m2wj-r6g3-fxfx published
Nov 10, 2023 by nicolas-grekasModerate -
Possible CSRF token fixationGHSA-3gv2-29qc-v67m published
Feb 1, 2023 by fabpotLow -
Prevent storing cookie headers in HttpCacheGHSA-h7vf-5wrv-9fhv published
Feb 1, 2023 by fabpotModerate -
CSRF token missing in formsGHSA-vvmr-8829-6whx published
Jan 29, 2022 by fabpotHigh -
Prevent CSV Injection via formulasGHSA-2xhg-w2g5-w95x published
Nov 24, 2021 by fabpotModerate -
Webcache Poisoning via X-Forwarded-Prefix and sub-requestGHSA-q3j3-w37x-hq2q published
Nov 24, 2021 by fabpotModerate -
Remember me cookie persistance after password changesGHSA-qw36-p97w-vcqr published
Nov 24, 2021 by fabpotModerate -
Authentication granted to all firewalls instead of just oneGHSA-rfcf-m67m-jcrq published
Jun 17, 2021 by fabpotHigh
Learn more about advisories related to symfony/symfony in the GitHub Advisory Database