{"kind": "product", "path": "vulns/packagist/symfony%2Fhttp-foundation", "name": "symfony/http-foundation", "product": "symfony/http-foundation", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-48736", "noindex": false, "published": "2026-07-14T19:09:30.260Z", "modified": "2026-07-15T13:23:06.394Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "severity": "medium", "epss": 0.0057, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48736", "title": "Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient", "description": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.", "references": ["https://github.com/symfony/symfony/security/advisories/GHSA-38cx-cq6f-5755", "https://github.com/symfony/symfony/commit/82765368cf74177c36613575182f168a2eb765b2", "https://github.com/symfony/symfony/commit/85b831555be8ea1f43bf01078afe87bc4c92f65e"], "fixes": ["6.4.41", "7.4.13", "8.0.13"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-64500", "noindex": false, "published": "2025-11-12T21:40:57.738Z", "modified": "2025-11-13T16:50:55.341Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.01408, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-64500", "title": "Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass", "description": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`.", "references": ["https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm", "https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac", "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2025-64500.yaml"], "fixes": ["5.4.50", "6.4.29", "7.3.7"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-50345", "noindex": false, "published": "2024-11-06T20:56:21.062Z", "modified": "2025-11-03T19:31:47.017Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00587, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-50345", "title": "Open redirect via browser-sanitized URLs in symfony/http-foundation", "description": "symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.", "references": ["https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp", "https://url.spec.whatwg.org", "https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html"], "fixes": ["5.4.46", "6.4.14", "7.1.7"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2015-2309", "noindex": false, "published": "2024-05-30T00:42:18Z", "modified": "2024-05-30T02:26:52.663391Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2015-2309", "title": "Symfony has unsafe methods in the Request class", "description": "All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue.\n\nThis issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore.\n\n### Description\nThe Symfony\\Component\\HttpFoundation\\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a \"non-trusted\" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middl", "references": ["https://github.com/symfony/symfony/pull/14166", "https://github.com/symfony/symfony/commit/6c73f0ce9302a0091bbfbb96f317e400ce16ef84", "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2015-2309.yaml"], "fixes": ["2.3.27", "2.5.11", "2.6.6"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2014-6061", "noindex": false, "published": "2024-05-30T00:41:16Z", "modified": "2024-05-30T02:26:52.578150Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2014-6061", "title": "Symfony has a security issue when parsing the Authorization header", "description": "All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.\n\nThis issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.\n\n### Description\nWhen an application uses an HTTP basic or digest authentication, Symfony does not parse the `Authorization` header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)\n\n### Resolution\nThe parsing of the `Authorization` header has been fixed to comply to the HTTP specification.\n\nThe patc", "references": ["https://github.com/symfony/symfony/pull/11829", "https://github.com/symfony/symfony/commit/3b4046e89467dc1fb5e079e377c2cfd4c239f904", "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-6061.yaml"], "fixes": ["2.3.19", "2.4.9", "2.5.4"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2014-5244", "noindex": false, "published": "2024-05-30T00:38:38Z", "modified": "2024-05-30T02:26:52.493741Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2014-5244", "title": "Symfony vulnerable to denial of service via a malicious HTTP Host header", "description": "All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.\n\nThis issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.\n\nDescription\nWhen an arbitrarily long hostname is sent by a client, its parsing in `Request::getHost()` can lead to a DoS attack, due to the way we validate the hostname via a regular expression.\n\nResolution\nThe regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submi", "references": ["https://github.com/symfony/symfony/pull/11828", "https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8", "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-5244.yaml"], "fixes": ["2.3.19", "2.4.9", "2.5.4"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "GHSA-vfm6-r2gc-pwww", "noindex": false, "published": "2024-05-30T00:34:48Z", "modified": "2024-12-04T05:41:25.742334Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-vfm6-r2gc-pwww", "title": "Symfony2 security issue when the trust proxy mode is enabled", "description": "An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control.\n\nTo fix this security issue, the following changes have been made to all versions of Symfony2:\n\nA new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument:\n```\n// before (probably in your front controller script)\nRequest::trustProxyData();\n\n// after\nRequest::setTrustedProxies(array('1.1.1.1'));\n// 1.1.1.1 being the IP address of ", "references": ["https://github.com/symfony/http-foundation/commit/5cde5229fc71a19cef2a0a933a18e08e43252f34", "https://github.com/symfony/http-foundation/commit/795ac45c188ee2a729db4513e9dfd30b16a0ed35", "https://github.com/symfony/symfony/commit/9ce892cf4395e73b136e9b5cd1fae9e91995c93b"], "fixes": ["2.0.19", "2.1.4"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2020-5255", "noindex": false, "published": "2020-03-30T19:30:15.000Z", "modified": "2024-08-04T08:22:09.086Z", "cvss": 2.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.01297, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2020-5255", "title": "Prevent cache poisoning via a Response Content-Type header", "description": "In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.", "references": ["https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859", "https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6", "https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-header"], "fixes": ["4.4.7", "5.0.7"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2013-4752", "noindex": false, "published": "2020-01-02T16:07:55.000Z", "modified": "2024-08-06T16:52:27.085Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.02313, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2013-4752", "title": "CVE-2013-4752", "description": "Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.", "references": ["http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4752", "https://exchange.xforce.ibmcloud.com/vulnerabilities/86367"], "fixes": ["2.0.24", "2.1.12", "2.2.5", "2.3.3"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2019-18888", "noindex": false, "published": "2019-11-21T22:19:52.000Z", "modified": "2024-08-05T02:02:39.762Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.02248, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2019-18888", "title": "CVE-2019-18888", "description": "An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).", "references": ["https://symfony.com/blog/symfony-4-3-8-released", "https://github.com/symfony/symfony/releases/tag/v4.3.8", "https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser"], "fixes": ["2.8.52", "3.4.35", "4.2.12", "4.3.8"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2019-10913", "noindex": false, "published": "2019-05-16T21:15:04.000Z", "modified": "2024-08-04T22:40:15.080Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.01871, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2019-10913", "title": "CVE-2019-10913", "description": "In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.", "references": ["https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides", "https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec", "https://nvd.nist.gov/vuln/detail/CVE-2019-10913"], "fixes": ["2.7.51", "2.8.50", "3.4.26", "4.1.12", "4.2.7"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2018-14773", "noindex": false, "published": "2018-08-03T17:00:00.000Z", "modified": "2024-08-05T09:38:13.839Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.57638, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2018-14773", "title": "CVE-2018-14773", "description": "An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \\Symfony\\Component\\HttpFoundation\\Request::prepareRequestUri() where X-Original-URL and X_REWRI", "references": ["http://www.securityfocus.com/bid/104943", "https://www.drupal.org/SA-CORE-2018-005", "https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html"], "fixes": ["2.7.49", "2.8.44", "3.3.18", "3.4.14", "4.0.14", "4.1.3"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2018-11386", "noindex": false, "published": "2018-06-13T16:00:00.000Z", "modified": "2024-08-05T08:10:13.702Z", "cvss": 5.9, "cvss_vector": "", "severity": "medium", "epss": 0.01582, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2018-11386", "title": "CVE-2018-11386", "description": "An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.", "references": ["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/"], "fixes": ["2.7.48", "2.8.41", "3.3.17", "3.4.11", "4.0.11"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}, {"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}, {"id": "CVE-2012-6431", "noindex": false, "published": "2012-12-27T11:00:00.000Z", "modified": "2024-09-17T00:46:20.194Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.01876, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2012-6431", "title": "CVE-2012-6431", "description": "Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.", "references": ["http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released", "https://nvd.nist.gov/vuln/detail/CVE-2012-6431"], "fixes": ["2.0.19"], "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}]}], "total": 14, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "symfony/http-foundation", "path": "vulns/packagist/symfony%2Fhttp-foundation", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-15T13:23:06.394Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}