이 문서는 v1 API를 사용하며, Snyk은 향후 개발을 REST API에 집중할 예정이므로 결국 지원이 중단될 예정입니다. 자세한 내용은 v1 API를 참조하십시오.
Test package.json & yarn.lock File
post
Test for issues in yarn files.You can test your yarn packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" package.json and a yarn.lock.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/yarn
200Success
Test sbt file
post
Test for issues in sbt files.You can test your sbt packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" build.sbt.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/sbt
200Success
sbt_Test for issues in a public package by group id, artifact id and version
get
Test for issues in sbt files.You can test sbt packages for issues according to their group ID, artifact ID and version. This is done via the maven endpoint (for Java), since the packages are hosted on maven central or a compatible repository. See "Maven" above for details.
Required permissions
View Organization
Test Packages
Path parameters
groupIdstringRequired
The package's group ID.
Example: org.apache.flex.blazeds
artifactIdstringRequired
The package's artifact ID.
Example: blazeds
versionstringRequired
The package version to test.
Example: 4.7.2
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/sbt/{groupId}/{artifactId}/{version}
200Success
Test gemfile.lock file
post
Test for issues in rubygems packages and applications.You can test your rubygems applications for issues according to their lockfile using this action. It takes a JSON object containing a the "target" Gemfile.lock.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 4a18d42f-0706-4ad0-b127-24078731fbed
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/rubygems
200Success
Test for issues in a public gem by name and version
get
Test for issues in rubygems packages and applications.You can test rubygems packages for issues according to their name and version.
Required permissions
View Organization
Test Packages
Path parameters
gemNamestringRequired
The gem name.
Example: rails-html-sanitizer
versionstringRequired
The gem version to test.
Example: 1.0.3
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 4a18d42f-0706-4ad0-b127-24078731fbed
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/rubygems/{gemName}/{version}
200Success
Test requirements.txt file
post
Test for issues in pip files.You can test your pip packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" requirements.txt.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/pip
200Success
pip_Test for issues in a public package by name and version
get
Test for issues in pip files.You can test pip packages for issues according to their name and version.
Required permissions
View Organization
Test Packages
Path parameters
packageNamestringRequired
The package name.
Example: rsa
versionstringRequired
The Package version to test.
Example: 3.3
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/pip/{packageName}/{version}
200Success
Test package.json & package-lock.json File
post
Test for issues in npm files.You can test your npm packages for issues according to their manifest file & optional lockfile using this action. It takes a JSON object containing a "target" package.json and optionally a package-lock.json.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/npm
200Success
Test for issues in a public package by name and version
get
Test for issues in npm files.You can test npm packages for issues according to their name and version.
Required permissions
View Organization
Test Packages
Path parameters
packageNamestringRequired
The package name. For scoped packages, must be url-encoded, so to test "@angular/core" version 4.3.2, one should GET /test/npm/%40angular%2Fcore/4.3.2.
Example: ms
versionstringRequired
The Package version to test.
Example: 0.7.0
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/npm/{packageName}/{version}
200Success
Test maven file
post
Test for issues in Maven files.You can test your Maven packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" pom.xml.
Additional manifest files, if they are needed, like parent pom.xml files, child poms, etc., according the the definitions in the target pom.xml file, should be supplied in the additional body parameter.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The Maven repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/maven
200Success
Test for issues in a public package by group id, artifact id and version
get
Test for issues in Maven files.You can test maven packages for issues according to their coordinates: group ID, artifact ID and version. The repository hosting the package may also be customized (see the repository query parameter).
Required permissions
View Organization
Test Packages
Path parameters
groupIdstringRequired
The package's group ID.
Example: org.apache.flex.blazeds
artifactIdstringRequired
The package's artifact ID.
Example: blazeds
versionstringRequired
The package version to test.
Example: 4.7.2
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The Maven repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/maven/{groupId}/{artifactId}/{version}
200Success
Test gradle file
post
Test for issues in Gradle files.You can test your Gradle packages for issues according to their manifest file using this action. It takes a JSON object containing the "target" build.gradle.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/gradle
200Success
Test for issues in a public package by group, name and version
get
Test for issues in Gradle files.You can test gradle packages for issues according to their group, name and version. This is done via the maven endpoint (for Java), since the packages are hosted on maven central or a compatible repository. See "Maven" above for details.
Required permissions
View Organization
Test Packages
Path parameters
groupstringRequired
The package's group ID.
Example: org.apache.flex.blazeds
namestringRequired
The package's artifact ID.
Example: blazeds
versionstringRequired
The package version to test.
Example: 4.7.2
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
repositorystringOptional
The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
Example: https://repo1.maven.org/maven2
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
get
/test/gradle/{group}/{name}/{version}
200Success
Test vendor.json File
post
Test for issues in Go vendor files.You can test your Go vendor packages for issues according to their manifest file using this action. It takes a JSON object containing a "target" vendor.json.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Body
encodingall ofOptional
string · enumOptional
the encoding for the manifest files sent.
Possible values:
and
anyOptional
the encoding for the manifest files sent.
Responses
200Success
application/json
okbooleanRequired
dependencyCountinteger · int32Required
licensesPolicystring · nullableRequired
packageManagerstringRequired
post
/test/govendor
200Success
Test Gopkg.toml & Gopkg.lock File
post
Test for issues in Go dep files.You can test your Go dep packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" Gopkg.toml and a Gopkg.lock.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
The organization to test the package with. See "The Snyk organization for a request" above.
Example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
Body
Responses
200Success
application/json
okbooleanRequired
packageManagerstringRequired
post
/test/dep-graph
200Success
Test composer.json & composer.lock file
post
Test for issues in PHP composer.json and composer.lock files.You can test your Composer packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" composer.json and a composer.lock.
Required permissions
View Organization
Test Packages
Query parameters
orgstringOptional
The organization to test the package with. See "The Snyk organization for a request" above.
{
"ok": true,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-COMNING-30317",
"url": "https://snyk.io/vuln/SNYK-JAVA-COMNING-30317",
"title": "Insufficient Verification of Data Authenticity",
"type": "vuln",
"description": "## Overview\n[`com.ning:async-http-client`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22async-http-client%22)\nAsync Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.\n\n## References\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7397)\n- [OSS Security](http://openwall.com/lists/oss-security/2014/08/26/1)\n- [GitHub Issue](https://github.com/AsyncHttpClient/async-http-client/issues/352)\n- [GitHub Commit](https://github.com/AsyncHttpClient/async-http-client/commit/dfacb8e05d0822c7b2024c452554bd8e1d6221d8)\n",
"functions": [],
"from": [
"net.databinder.dispatch:[email protected]",
"com.ning:[email protected]"
],
"package": "com.ning:async-http-client",
"version": "1.8.10",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[,1.9.0)"
]
},
"publicationTime": "2017-03-28T08:29:28.375000Z",
"disclosureTime": "2015-06-24T16:59:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2013-7397"
],
"CWE": [
"CWE-345"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssScore": 4.3,
"patches": [],
"upgradePath": [
"net.databinder.dispatch:[email protected]",
"com.ning:[email protected]"
]
}
],
"licenses": [
{
"id": "snyk:lic:maven:net.databinder.dispatch:dispatch-core_2.11:LGPL-3.0",
"url": "https://snyk.io/vuln/snyk:lic:maven:net.databinder.dispatch:dispatch-core_2.11:LGPL-3.0",
"title": "LGPL-3.0 license",
"type": "license",
"from": [
"net.databinder.dispatch:[email protected]"
],
"package": "net.databinder.dispatch:dispatch-core_2.11",
"version": "0.11.2",
"severity": "medium",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[0,)"
]
}
}
]
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": "text",
"packageManager": "text"
}
GET /v1/test/sbt/{groupId}/{artifactId}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\n\n[org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nThe AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.\n\n\nStarting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:\n```\nflex.messaging.io.amf.ASObject\nflex.messaging.io.amf.SerializedObject\nflex.messaging.io.ArrayCollection\nflex.messaging.io.ArrayList\nflex.messaging.messages.AcknowledgeMessage\nflex.messaging.messages.AcknowledgeMessageExt\nflex.messaging.messages.AsyncMessage\nflex.messaging.messages.AsyncMessageExt\nflex.messaging.messages.CommandMessage\nflex.messaging.messages.CommandMessageExt\nflex.messaging.messages.ErrorMessage\nflex.messaging.messages.HTTPMessage\nflex.messaging.messages.RemotingMessage\nflex.messaging.messages.SOAPMessage\njava.lang.Boolean\njava.lang.Byte\njava.lang.Character\njava.lang.Double\njava.lang.Float\njava.lang.Integer\njava.lang.Long\njava.lang.Object\njava.lang.Short\njava.lang.String\njava.util.ArrayList\njava.util.Date\njava.util.HashMap\norg.w3c.dom.Document\n```\n\n## Remediation\n\nUpgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.\n\n\n## References\n\n- [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)\n\n- [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)\n\n- [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)\n\n- [Securitytracker Issue](http://www.securitytracker.com/id/1038364)\n",
"functions": [],
"from": [
"org.apache.flex.blazeds:[email protected]"
],
"package": "org.apache.flex.blazeds:blazeds",
"version": "4.7.2",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[,4.7.3)"
]
},
"publicationTime": "2017-08-09T14:17:08Z",
"disclosureTime": "2017-04-25T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2017-5641"
],
"CWE": [
"CWE-502"
]
},
"credit": [
"Markus Wulftange"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": [
"org.apache.flex.blazeds:[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": null,
"packageManager": "maven"
}
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-RUBY-JSON-20000",
"url": "https://snyk.io/vuln/SNYK-RUBY-JSON-20000",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\n\nThe [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.\nAffected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service, or potentially allowing the [execution of arbitrary code](https://snyk.io/vuln/SNYK-RUBY-JSON-20209).\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\n\nTwo common types of DoS vulnerabilities:\n\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](npm:ws:20171108)\n\n## References\n- http://rubysec.com/advisories/OSVDB-101157\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "json",
"version": "1.0.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"< 1.1.0"
]
},
"publicationTime": "2007-05-20T21:00:00Z",
"disclosureTime": "2007-05-20T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-400"
],
"OSVDB": [
"OSVDB-101157"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssScore": 7.5,
"patches": [],
"upgradePath": [
"[email protected]"
]
},
{
"id": "SNYK-RUBY-JSON-20060",
"url": "https://snyk.io/vuln/SNYK-RUBY-JSON-20060",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\nThe [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.\nAffected versions of this Gem are vulnerable to Denial of Service (DoS) attacks and unsafe object creation vulnerabilities. When parsing certain JSON documents, the JSON gem tricked into creating Ruby symbols in a target system.\n\n## Details\n\nWhen parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system. Since Ruby symbols are not garbage collected, this can result in a denial of service attack.\n\nThe same technique can be used to create objects in a target system that act like internal objects. These \"act alike\" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.\n\nImpacted code looks like this:\n```js\nJSON.parse(user_input)\n```\nWhere the `user_input` variable will have a JSON document like this:\n```json\n{\"json_class\":\"foo\"}\n```\nThe JSON gem will attempt to look up the constant \"foo\". Looking up this constant will create a symbol.\n\nIn JSON version 1.7.x, objects with arbitrary attributes can be created using JSON documents like this:\n```json\n{\"json_class\":\"JSON::GenericObject\",\"foo\":\"bar\"}\n```\nThis document will result in an instance of `JSON::GenericObject`, with the attribute \"foo\" that has the value \"bar\". Instantiating these objects will result in arbitrary symbol creation and in some cases can be used to bypass security measures.\n\nPLEASE NOTE: this behavior *does not change* when using `JSON.load`. `JSON.load` should *never* be given input from unknown sources. If you are processing JSON from an unknown source, *always* use `JSON.parse`.\n\n## References\n- https://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/\n- https://gist.github.com/rsierra/4943505\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "json",
"version": "1.0.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"< 1.7.7, >= 1.7",
"< 1.6.8, >= 1.6",
"< 1.5.5"
]
},
"publicationTime": "2013-02-10T22:00:00Z",
"disclosureTime": "2013-02-10T22:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2013-0269"
],
"CWE": [
"CWE-400"
],
"OSVDB": [
"OSVDB-90074"
]
},
"credit": [
"Thomas Hollstegge",
"Ben Murphy"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": [
"[email protected]"
]
},
{
"id": "SNYK-RUBY-JSON-20209",
"url": "https://snyk.io/vuln/SNYK-RUBY-JSON-20209",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\n\nThe [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.\n\nAffected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a [denial of service](https://snyk.io/vuln/SNYK-RUBY-JSON-20000), or potentially allowing the execution of arbitrary code.\n\n## References\n\n- http://rubysec.com/advisories/OSVDB-101157\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "json",
"version": "1.0.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"< 1.1.0"
]
},
"publicationTime": "2007-05-20T21:00:00Z",
"disclosureTime": "2007-05-20T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-94"
],
"OSVDB": [
"OSVDB-101157-1"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssScore": 7.5,
"patches": [],
"upgradePath": [
"[email protected]"
]
},
{
"id": "SNYK-RUBY-RACK-538324",
"url": "https://snyk.io/vuln/SNYK-RUBY-RACK-538324",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\n\n[rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.\n\n\nAffected versions of this package are vulnerable to Information Exposure.\nAttackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.\n\n## Remediation\n\nUpgrade `rack` to version 1.6.12, 2.0.8 or higher.\n\n\n## References\n\n- [GitHub Fix Commit](https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38)\n\n- [GitHub Security Advisory](https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3)\n",
"functions": [],
"from": [
"[email protected]",
"[email protected]",
"[email protected]"
],
"package": "rack",
"version": "2.0.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"<1.6.12",
">=2.0.0.alpha, <2.0.8"
]
},
"publicationTime": "2019-12-19T20:24:49Z",
"disclosureTime": "2019-12-18T20:24:49Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2019-16782"
],
"CWE": [
"CWE-200"
]
},
"credit": [
"Will Leinweber"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": [
"[email protected]",
"[email protected]",
"[email protected]"
]
},
{
"id": "SNYK-RUBY-RACK-72567",
"url": "https://snyk.io/vuln/SNYK-RUBY-RACK-72567",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\n\n[rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS)\nvia the `scheme` method on `Rack::Request`.\n\n## Remediation\n\nUpgrade `rack` to version 1.6.11, 2.0.6 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/rack/rack/commit/313dd6a05a5924ed6c82072299c53fed09e39ae7)\n\n- [Google Security Forum](https://groups.google.com/forum/#!msg/rubyonrails-security/GKsAFT924Ag/DYtk-Xl6AAAJ)\n\n- [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1646818)\n",
"functions": [],
"from": [
"[email protected]",
"[email protected]",
"[email protected]"
],
"package": "rack",
"version": "2.0.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"<1.6.11",
">=2.0.0, <2.0.6"
]
},
"publicationTime": "2018-11-06T16:08:37Z",
"disclosureTime": "2018-08-22T15:56:49Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-16470"
],
"CWE": [
"CWE-79"
]
},
"credit": [
"Aaron Patterson"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": [
"[email protected]",
"[email protected]",
"[email protected]"
]
},
{
"id": "SNYK-RUBY-RACKCACHE-20031",
"url": "https://snyk.io/vuln/SNYK-RUBY-RACKCACHE-20031",
"title": "HTTP Header Caching Weakness",
"type": "vuln",
"description": "## Overview\n[rack-cache](https://rubygems.org/gems/rack-cache) enables HTTP caching for Rack-based applications.\nAffected versions of this gem contain a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header.\n\n## References\n- http://rubysec.com/advisories/CVE-2012-2671\n",
"functions": [],
"from": [
"[email protected]",
"[email protected]"
],
"package": "rack-cache",
"version": "1.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"< 1.2"
]
},
"publicationTime": "2012-06-05T21:00:00Z",
"disclosureTime": "2012-06-05T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2012-2671"
],
"CWE": [
"CWE-444"
],
"OSVDB": [
"OSVDB-83077"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": [
"[email protected]",
"[email protected]"
]
},
{
"id": "SNYK-RUBY-REDISSTORE-20452",
"url": "https://snyk.io/vuln/SNYK-RUBY-REDISSTORE-20452",
"title": "Deserialization of Untrusted Data",
"type": "vuln",
"description": "## Overview\n[`redis-store`](https://rubygems.org/gems/redis-store) is a namespaced Rack::Session, Rack::Cache, I18n and cache Redis stores for Ruby web frameworks.\n\nAffected versions of the package are vulnerable to Deserialization of Untrusted Data.\n\n# Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\n\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\n\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\n\n## Remediation\nUpgrade `redis-store` to version 1.4.0 or higher.\n\n## References\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-1000248)\n- [GitHub PR](https://github.com/redis-store/redis-store/pull/290)\n- [GitHub Issue](https://github.com/redis-store/redis-store/issues/289)\n- [GitHub Commit](https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e)\n",
"functions": [],
"from": [
"[email protected]",
"[email protected]"
],
"package": "redis-store",
"version": "1.1.0",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"<1.4.0"
]
},
"publicationTime": "2017-12-07T09:52:33.659000Z",
"disclosureTime": "2017-08-10T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2017-1000248"
],
"CWE": [
"CWE-502"
]
},
"credit": [
"Dylan Katz"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": [
"[email protected]",
"[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 6,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "rubygems"
}
GET /v1/test/rubygems/{gemName}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-RUBY-RAILSHTMLSANITIZER-22025",
"url": "https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-22025",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\n[rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer)\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications.\n\nThis issue is similar to [CVE-2018-8048](https://snyk.io/vuln/SNYK-RUBY-LOOFAH-22023) in Loofah.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `rails-html-sanitizer` to version 1.0.4 or higher.\n\n## References\n- [Ruby on Rails Security Google Forum](https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-3741)\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "rails-html-sanitizer",
"version": "1.0.3",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "ruby",
"packageManager": "rubygems",
"semver": {
"vulnerable": [
"<1.0.4"
]
},
"publicationTime": "2018-03-27T07:42:10.777000Z",
"disclosureTime": "2018-03-22T21:46:15.453000Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-3741"
],
"CWE": [
"CWE-79"
]
},
"credit": [
"Kaarlo Haikonen"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": [
"[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 5,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "rubygems"
}
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-PYTHON-OAUTH2-40013",
"url": "https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40013",
"title": "Replay Attack",
"type": "vuln",
"description": "## Overview\n[`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9\nThe Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.\n\n\n## Remediation\nUpgrade to version `1.9rc1` or greater.\n\n\n## References\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4346)\n- [Bugzilla redhat](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4346)\n- [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/129)\n\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "oauth2",
"version": "1.5.211",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "python",
"packageManager": "pip",
"semver": {
"vulnerable": [
"[,1.9rc1)"
]
},
"publicationTime": "2013-02-05T12:31:58Z",
"disclosureTime": "2013-02-05T12:31:58Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": true,
"identifiers": {
"CVE": [
"CVE-2013-4346"
],
"CWE": [
"CWE-310"
]
},
"credit": [
"André Cruz"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"cvssScore": 4.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PYTHON-OAUTH2-40014",
"url": "https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40014",
"title": "Insecure Randomness",
"type": "vuln",
"description": "## Overview\n[`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9\n\n\nAffected versions of this package are vulnerable to Insecure Randomness.\nThe (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.\n\n\n## Remediation\nUpgrade to version `1.9rc1` or greater.\n\n\n## References\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4347)\n- [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/9)\n- [Openwall](http://www.openwall.com/lists/oss-security/2013/09/12/7)\n- [GitHub PR](https://github.com/simplegeo/python-oauth2/pull/146)\n\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "oauth2",
"version": "1.5.211",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "python",
"packageManager": "pip",
"semver": {
"vulnerable": [
"[,1.9rc1)"
]
},
"publicationTime": "2017-04-13T12:31:58Z",
"disclosureTime": "2014-05-20T14:55:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": true,
"identifiers": {
"CVE": [
"CVE-2013-4347"
],
"CWE": [
"CWE-310"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cvssScore": 5.4,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PYTHON-SUPERVISOR-40610",
"url": "https://snyk.io/vuln/SNYK-PYTHON-SUPERVISOR-40610",
"title": "Arbitrary Command Execution",
"type": "vuln",
"description": "## Overview\n[`supervisor`](https://pypi.python.org/pypi/supervisor/) is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating systems.\n\n\nAffected versions of the package are vulnerable to Arbitrary Command Execution. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.\n\n\n## Details\n* `supervisord` is the server component and is responsible for starting child processes, responding to commands from clients, and other commands.\n* `supervisorctl` is the command line component, providing a shell-like interface to the features provided by `supervisord`.\n\n\n`supervisord` can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. This HTTP server is how `supervisorctl` communicates with `supervisord`. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.\nThis vulnerability can only be exploited by an authenticated client or if `supervisord` has been configured to run an HTTP server without authentication. If authentication has not been enabled, `supervisord` will log a message at the critical level every time it starts.\n\n\n## PoC by Maor Shwartz\n\n\nCreate a config file `supervisord.conf`:\n\n\n```conf\n[supervisord]\nloglevel = trace\n\n\n[inet_http_server]\nport = 127.0.0.1:9001\n\n\n[rpcinterface:supervisor]\nsupervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface\n```\n\n\nStart supervisord in the foreground with that config file:\n\n\n```\n$ supervisord -n -c supervisord.conf\n```\n\n\nIn a new terminal:\n\n\n```py\n$ python2\n>>> from xmlrpclib import ServerProxy\n>>> server = ServerProxy('http://127.0.0.1:9001/RPC2')\n>>> server.supervisor.supervisord.options.execve('/bin/sh', [], {})\n\n ```\n\n\n\nIf the `supervisord` version is vulnerable, the `execve` will be executed and the `supervisord` process will be replaced with /bin/sh (or any other command given). If the `supervisord` version is not vulnerable, it will return an `UNKNOWN_METHOD` fault.\n\n\n\n\n## Remediation\nUpgrade `supervisor` to version 3.3.3 or higher.\n\n\n## References\n- [Github Issue](https://github.com/Supervisor/supervisor/issues/964)\n- [Github Commit 3.0.1](https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0)\n- [Github Commit 3.1.4](https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88)\n- [Github Commit 3.2.4](https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e)\n- [Github Commit 3.3.3](https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e)",
"functions": [],
"from": [
"[email protected]"
],
"package": "supervisor",
"version": "3.1.0",
"severity": "high",
"exploitMaturity": "mature",
"language": "python",
"packageManager": "pip",
"semver": {
"vulnerable": [
"[3.0a1,3.0.1)",
"[3.1.0,3.1.4)",
"[3.2.0,3.2.4)",
"[3.3.0,3.3.3)"
]
},
"publicationTime": "2017-08-08T06:59:14Z",
"disclosureTime": "2017-07-18T21:00:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": true,
"identifiers": {
"CVE": [
"CVE-2017-11610"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Maor Shwartz"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
"cvssScore": 8.8,
"patches": [],
"upgradePath": []
}
],
"licenses": []
},
"dependencyCount": 4,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "pip"
}
GET /v1/test/pip/{packageName}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": true,
"issues": {
"vulnerabilities": [
{
"id": "npm:node-uuid:20160328",
"url": "https://snyk.io/vuln/npm:node-uuid:20160328",
"title": "Insecure Randomness",
"type": "vuln",
"description": "## Overview\n[`node-uuid`](https://github.com/kelektiv/node-uuid) is a Simple, fast generation of RFC4122 UUIDS.\n\nAffected versions of this package are vulnerable to Insecure Randomness. It uses the cryptographically insecure `Math.random` which can produce predictable values and should not be used in security-sensitive context.\n\n## Remediation\nUpgrade `node-uuid` to version 1.4.4 or greater.\n\n## References\n- [GitHub Issue](https://github.com/broofa/node-uuid/issues/108)\n- [GitHub Issue 2](https://github.com/broofa/node-uuid/issues/122)\n",
"functions": [],
"from": [
"[email protected]"
],
"package": "node-uuid",
"version": "1.4.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "js",
"packageManager": "npm",
"semver": {
"vulnerable": [
"<1.4.4"
]
},
"publicationTime": "2016-03-28T22:00:02.566000Z",
"disclosureTime": "2016-03-28T21:29:30Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"ALTERNATIVE": [
"SNYK-JS-NODEUUID-10089"
],
"CVE": [],
"CWE": [
"CWE-330"
],
"NSP": [
93
]
},
"credit": [
"Fedot Praslov"
],
"CVSSv3": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssScore": 4.2,
"patches": [
{
"comments": [],
"id": "patch:npm:node-uuid:20160328:0",
"modificationTime": "2019-12-03T11:40:45.815314Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/node-uuid/20160328/node-uuid_20160328_0_0_616ad3800f35cf58089215f420db9654801a5a02.patch"
],
"version": "<=1.4.3 >=1.4.2"
}
],
"upgradePath": [
"[email protected]"
]
}
],
"licenses": [
"text"
]
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": "text",
"packageManager": "text"
}
GET /v1/test/npm/{packageName}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "npm:ms:20151024",
"url": "https://snyk.io/vuln/npm:ms:20151024",
"title": "Regular Expression Denial of Service (ReDoS)",
"type": "vuln",
"description": "## Overview\n\n[ms](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.\n\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS)\nattack when converting a time period string (i.e. `\"2 days\"`, `\"1h\"`) into a milliseconds integer. A malicious user could pass extremely long strings to `ms()`, causing the server to take a long time to process, subsequently blocking the event loop for that extended period.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\n\nUpgrade `ms` to version 0.7.1 or higher.\n\n\n## References\n\n- [OSS Security advisory](https://www.openwall.com/lists/oss-security/2016/04/20/11)\n\n- [OWASP - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)\n\n- [Security Focus](https://www.securityfocus.com/bid/96389)\n",
"functions": [
{
"functionId": {
"filePath": "ms.js",
"functionName": "parse"
},
"version": [
">0.1.0 <=0.3.0"
]
},
{
"functionId": {
"filePath": "index.js",
"functionName": "parse"
},
"version": [
">0.3.0 <0.7.1"
]
}
],
"from": [
"[email protected]"
],
"package": "ms",
"version": "0.7.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "js",
"packageManager": "npm",
"semver": {
"vulnerable": [
"<0.7.1"
]
},
"publicationTime": "2015-11-06T02:09:36Z",
"disclosureTime": "2015-10-24T20:39:59Z",
"isUpgradable": true,
"isPatchable": true,
"isPinnable": false,
"identifiers": {
"ALTERNATIVE": [
"SNYK-JS-MS-10064"
],
"CVE": [
"CVE-2015-8315"
],
"CWE": [
"CWE-400"
],
"NSP": [
46
]
},
"credit": [
"Adam Baldwin"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssScore": 5.3,
"patches": [
{
"comments": [],
"id": "patch:npm:ms:20151024:5",
"modificationTime": "2019-12-03T11:40:45.777474Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch"
],
"version": "=0.1.0"
},
{
"comments": [],
"id": "patch:npm:ms:20151024:4",
"modificationTime": "2019-12-03T11:40:45.776329Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_4_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk4.patch"
],
"version": "=0.2.0"
},
{
"comments": [],
"id": "patch:npm:ms:20151024:3",
"modificationTime": "2019-12-03T11:40:45.775292Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_3_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk3.patch"
],
"version": "=0.3.0"
},
{
"comments": [],
"id": "patch:npm:ms:20151024:2",
"modificationTime": "2019-12-03T11:40:45.774221Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_2_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk2.patch"
],
"version": "<0.6.0 >0.3.0"
},
{
"comments": [],
"id": "patch:npm:ms:20151024:1",
"modificationTime": "2019-12-03T11:40:45.773094Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_1_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk.patch"
],
"version": "<0.7.0 >=0.6.0"
},
{
"comments": [],
"id": "patch:npm:ms:20151024:0",
"modificationTime": "2019-12-03T11:40:45.772009Z",
"urls": [
"https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_0_0_48701f029417faf65e6f5e0b61a3cebe5436b07b.patch"
],
"version": "=0.7.0"
}
],
"upgradePath": [
"[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "npm"
}
{
"ok": true,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-AXIS-30071",
"url": "https://snyk.io/vuln/SNYK-JAVA-AXIS-30071",
"title": "Man-in-the-Middle (MitM)",
"type": "vuln",
"description": "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate. \r\n\r\n## Details\r\nThe `getCN` function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. \r\n\r\n**NOTE:** this issue exists because of an incomplete fix for [CVE-2012-5784](https://snyk.io/vuln/SNYK-JAVA-AXIS-30189).\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Axis Issue](https://issues.apache.org/jira/browse/AXIS-2905)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596)\n\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3596)\n",
"functions": [],
"from": [
"axis:[email protected]"
],
"package": "axis:axis",
"version": "1.4",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[0,]"
]
},
"publicationTime": "2014-08-18T16:51:53Z",
"disclosureTime": "2014-08-18T16:51:53Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-3596"
],
"CWE": [
"CWE-297"
]
},
"credit": [
"David Jorm",
"Arun Neelicattu"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cvssScore": 5.4,
"patches": [],
"upgradePath": []
}
],
"licenses": [
"text"
]
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": "text",
"packageManager": "text"
}
GET /v1/test/maven/{groupId}/{artifactId}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\n\n[org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nThe AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.\n\n\nStarting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:\n```\nflex.messaging.io.amf.ASObject\nflex.messaging.io.amf.SerializedObject\nflex.messaging.io.ArrayCollection\nflex.messaging.io.ArrayList\nflex.messaging.messages.AcknowledgeMessage\nflex.messaging.messages.AcknowledgeMessageExt\nflex.messaging.messages.AsyncMessage\nflex.messaging.messages.AsyncMessageExt\nflex.messaging.messages.CommandMessage\nflex.messaging.messages.CommandMessageExt\nflex.messaging.messages.ErrorMessage\nflex.messaging.messages.HTTPMessage\nflex.messaging.messages.RemotingMessage\nflex.messaging.messages.SOAPMessage\njava.lang.Boolean\njava.lang.Byte\njava.lang.Character\njava.lang.Double\njava.lang.Float\njava.lang.Integer\njava.lang.Long\njava.lang.Object\njava.lang.Short\njava.lang.String\njava.util.ArrayList\njava.util.Date\njava.util.HashMap\norg.w3c.dom.Document\n```\n\n## Remediation\n\nUpgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.\n\n\n## References\n\n- [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)\n\n- [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)\n\n- [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)\n\n- [Securitytracker Issue](http://www.securitytracker.com/id/1038364)\n",
"functions": [],
"from": [
"org.apache.flex.blazeds:[email protected]"
],
"package": "org.apache.flex.blazeds:blazeds",
"version": "4.7.2",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[,4.7.3)"
]
},
"publicationTime": "2017-08-09T14:17:08Z",
"disclosureTime": "2017-04-25T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2017-5641"
],
"CWE": [
"CWE-502"
]
},
"credit": [
"Markus Wulftange"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": [
"org.apache.flex.blazeds:[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": null,
"packageManager": "maven"
}
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-AXIS-30071",
"url": "https://snyk.io/vuln/SNYK-JAVA-AXIS-30071",
"title": "Man-in-the-Middle (MitM)",
"type": "vuln",
"description": "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate. \r\n\r\n## Details\r\nThe `getCN` function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. \r\n\r\n**NOTE:** this issue exists because of an incomplete fix for [CVE-2012-5784](https://snyk.io/vuln/SNYK-JAVA-AXIS-30189).\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Axis Issue](https://issues.apache.org/jira/browse/AXIS-2905)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596)\n\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3596)\n",
"functions": [],
"from": [
"axis:[email protected]"
],
"package": "axis:axis",
"version": "1.4",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[0,]"
]
},
"publicationTime": "2014-08-18T16:51:53Z",
"disclosureTime": "2014-08-18T16:51:53Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-3596"
],
"CWE": [
"CWE-297"
]
},
"credit": [
"David Jorm",
"Arun Neelicattu"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cvssScore": 5.4,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-JAVA-AXIS-30189",
"url": "https://snyk.io/vuln/SNYK-JAVA-AXIS-30189",
"title": "Man-in-the-Middle (MitM)",
"type": "vuln",
"description": "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate.\n\n\n## Details\nApache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Jira Issue](https://issues.apache.org/jira/browse/AXIS-2883)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5784)\n\n- [Texas University](http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf)\n",
"functions": [],
"from": [
"axis:[email protected]"
],
"package": "axis:axis",
"version": "1.4",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[0,]"
]
},
"publicationTime": "2017-03-13T08:00:21Z",
"disclosureTime": "2012-11-04T22:55:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2012-5784"
],
"CWE": [
"CWE-20"
]
},
"credit": [
"Alberto Fernández"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"cvssScore": 5.4,
"patches": [],
"upgradePath": []
}
],
"licenses": []
},
"dependencyCount": 6,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "gradle"
}
GET /v1/test/gradle/{group}/{name}/{version} HTTP/1.1
Host: api.snyk.io
Accept: */*
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\n\n[org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nThe AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.\n\n\nStarting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:\n```\nflex.messaging.io.amf.ASObject\nflex.messaging.io.amf.SerializedObject\nflex.messaging.io.ArrayCollection\nflex.messaging.io.ArrayList\nflex.messaging.messages.AcknowledgeMessage\nflex.messaging.messages.AcknowledgeMessageExt\nflex.messaging.messages.AsyncMessage\nflex.messaging.messages.AsyncMessageExt\nflex.messaging.messages.CommandMessage\nflex.messaging.messages.CommandMessageExt\nflex.messaging.messages.ErrorMessage\nflex.messaging.messages.HTTPMessage\nflex.messaging.messages.RemotingMessage\nflex.messaging.messages.SOAPMessage\njava.lang.Boolean\njava.lang.Byte\njava.lang.Character\njava.lang.Double\njava.lang.Float\njava.lang.Integer\njava.lang.Long\njava.lang.Object\njava.lang.Short\njava.lang.String\njava.util.ArrayList\njava.util.Date\njava.util.HashMap\norg.w3c.dom.Document\n```\n\n## Remediation\n\nUpgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.\n\n\n## References\n\n- [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)\n\n- [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)\n\n- [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)\n\n- [Securitytracker Issue](http://www.securitytracker.com/id/1038364)\n",
"functions": [],
"from": [
"org.apache.flex.blazeds:[email protected]"
],
"package": "org.apache.flex.blazeds:blazeds",
"version": "4.7.2",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "java",
"packageManager": "maven",
"semver": {
"vulnerable": [
"[,4.7.3)"
]
},
"publicationTime": "2017-08-09T14:17:08Z",
"disclosureTime": "2017-04-25T21:00:00Z",
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2017-5641"
],
"CWE": [
"CWE-502"
]
},
"credit": [
"Markus Wulftange"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": [
"org.apache.flex.blazeds:[email protected]"
]
}
],
"licenses": []
},
"dependencyCount": 1,
"org": {
"name": "atokeneduser",
"id": "689ce7f9-7943-4a71-b704-2ba575f01089"
},
"licensesPolicy": null,
"packageManager": "maven"
}
{
"ok": false,
"packageManager": "maven",
"issuesData": {
"SNYK-JAVA-CHQOSLOGBACK-30208": {
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Unknown"
],
"cvssScore": 9.8,
"description": "## Overview\n\n[ch.qos.logback:logback-core](https://mvnrepository.com/artifact/ch.qos.logback/logback-core) is a logback-core module.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nA configuration can be turned on to allow remote logging through interfaces that accept untrusted serialized data. Authenticated attackers on the adjacent network can exploit this vulnerability to run arbitrary code through the deserialization of custom gadget chains.\n\n## Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\r\n\r\n \r\n\r\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\r\n\r\n \r\n\r\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\r\n\r\n \r\n\r\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\r\n\r\n \r\n\r\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\r\n\r\n- Apache Blog\r\n\r\n \r\n\r\nThe vulnerability, also know as _Mad Gadget_\r\n\r\n> Mad Gadget is one of the most pernicious vulnerabilities we’ve seen. By merely existing on the Java classpath, seven “gadget” classes in Apache Commons Collections (versions 3.0, 3.1, 3.2, 3.2.1, and 4.0) make object deserialization for the entire JVM process Turing complete with an exec function. Since many business applications use object deserialization to send messages across the network, it would be like hiring a bank teller who was trained to hand over all the money in the vault if asked to do so politely, and then entrusting that teller with the key. The only thing that would keep a bank safe in such a circumstance is that most people wouldn’t consider asking such a question.\r\n\r\n- Google\n\n## Remediation\n\nUpgrade `ch.qos.logback:logback-core` to version 1.1.11 or higher.\n\n\n## References\n\n- [Logback News](https://logback.qos.ch/news.html)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929/)\n",
"disclosureTime": "2017-03-13T06:59:00Z",
"fixedIn": [
"1.1.11"
],
"id": "SNYK-JAVA-CHQOSLOGBACK-30208",
"identifiers": {
"CVE": [
"CVE-2017-5929"
],
"CWE": [
"CWE-502"
]
},
"language": "java",
"mavenModuleName": {
"artifactId": "logback-core",
"groupId": "ch.qos.logback"
},
"moduleName": "ch.qos.logback:logback-core",
"packageManager": "maven",
"packageName": "ch.qos.logback:logback-core",
"patches": [],
"semver": {
"vulnerable": [
"[, 1.1.11)"
]
},
"severity": "critical",
"title": "Arbitrary Code Execution"
}
},
"issues": [
{
"pkgName": "ch.qos.logback:logback-core",
"pkgVersion": "1.0.13",
"issueId": "SNYK-JAVA-CHQOSLOGBACK-30208",
"fixInfo": {}
}
],
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
}
}
POST /v1/test/composer HTTP/1.1
Host: api.snyk.io
Content-Type: application/json
Accept: */*
Content-Length: 28009
{
"encoding": "plain",
"files": {
"target": {
"contents": "{\"name\": \"vulnerable/project\",\"description\": \"A sample vulnerable project\",\"require\": {\"php\": \">=5.3.2\",\"symfony/symfony\": \"v2.3.1\",\"yiisoft/yii\": \"1.1.14\",\"zendframework/zendframework\": \"2.1.0\",\"aws/aws-sdk-php\": \"3.0.0\",\"doctrine/common\": \"2.5.0\"}}"
},
"additional": [
{
"contents": "{\"_readme\":[\"This file locks the dependencies of your project to a known state\",\"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file\",\"This file is @generated automatically\"],\"content-hash\":\"3a3771e545494c4c098e639bd68602ba\",\"packages\":[{\"name\":\"aws/aws-sdk-php\",\"version\":\"3.0.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/aws/aws-sdk-php.git\",\"reference\":\"4018c8f14a9e53003bb0417fa859c6a7ad57b53b\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/aws/aws-sdk-php/zipball/4018c8f14a9e53003bb0417fa859c6a7ad57b53b\",\"reference\":\"4018c8f14a9e53003bb0417fa859c6a7ad57b53b\",\"shasum\":\"\"},\"require\":{\"guzzlehttp/guzzle\":\"^5.3 || ^6.0.1\",\"guzzlehttp/promises\":\"^1.0.0\",\"guzzlehttp/psr7\":\"^1.0.0\",\"mtdowling/jmespath.php\":\"^2.2\",\"php\":\">=5.5\"},\"require-dev\":{\"ext-dom\":\"*\",\"ext-json\":\"*\",\"ext-openssl\":\"*\",\"ext-pcre\":\"*\",\"ext-simplexml\":\"*\",\"ext-spl\":\"*\",\"phpunit/phpunit\":\"^4.0\"},\"suggest\":{\"ext-curl\":\"To send requests using cURL\",\"ext-openssl\":\"Allows working with CloudFront private distributions and verifying received SNS messages\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"3.0-dev\"}},\"autoload\":{\"psr-4\":{\"Aws\\\":\"src/\"},\"files\":[\"src/functions.php\"]},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"Apache-2.0\"],\"authors\":[{\"name\":\"Amazon Web Services\",\"homepage\":\"http://aws.amazon.com\"}],\"description\":\"AWS SDK for PHP - Use Amazon Web Services in your PHP project\",\"homepage\":\"http://aws.amazon.com/sdkforphp\",\"keywords\":[\"amazon\",\"aws\",\"cloud\",\"dynamodb\",\"ec2\",\"glacier\",\"s3\",\"sdk\"],\"time\":\"2015-05-27T20:07:42+00:00\"},{\"name\":\"doctrine/annotations\",\"version\":\"v1.5.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/annotations.git\",\"reference\":\"5beebb01b025c94e93686b7a0ed3edae81fe3e7f\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/annotations/zipball/5beebb01b025c94e93686b7a0ed3edae81fe3e7f\",\"reference\":\"5beebb01b025c94e93686b7a0ed3edae81fe3e7f\",\"shasum\":\"\"},\"require\":{\"doctrine/lexer\":\"1.*\",\"php\":\"^7.1\"},\"require-dev\":{\"doctrine/cache\":\"1.*\",\"phpunit/phpunit\":\"^5.7\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.5.x-dev\"}},\"autoload\":{\"psr-4\":{\"Doctrine\\Common\\Annotations\\\":\"lib/Doctrine/Common/Annotations\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Benjamin Eberlei\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Jonathan Wage\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Docblock Annotations Parser\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"annotations\",\"docblock\",\"parser\"],\"time\":\"2017-07-22T10:58:02+00:00\"},{\"name\":\"doctrine/cache\",\"version\":\"v1.7.1\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/cache.git\",\"reference\":\"b3217d58609e9c8e661cd41357a54d926c4a2a1a\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/cache/zipball/b3217d58609e9c8e661cd41357a54d926c4a2a1a\",\"reference\":\"b3217d58609e9c8e661cd41357a54d926c4a2a1a\",\"shasum\":\"\"},\"require\":{\"php\":\"~7.1\"},\"conflict\":{\"doctrine/common\":\">2.2,<2.4\"},\"require-dev\":{\"alcaeus/mongo-php-adapter\":\"^1.1\",\"mongodb/mongodb\":\"^1.1\",\"phpunit/phpunit\":\"^5.7\",\"predis/predis\":\"~1.0\"},\"suggest\":{\"alcaeus/mongo-php-adapter\":\"Required to use legacy MongoDB driver\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.7.x-dev\"}},\"autoload\":{\"psr-4\":{\"Doctrine\\Common\\Cache\\\":\"lib/Doctrine/Common/Cache\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Benjamin Eberlei\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Jonathan Wage\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Caching library offering an object-oriented API for many cache backends\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"cache\",\"caching\"],\"time\":\"2017-08-25T07:02:50+00:00\"},{\"name\":\"doctrine/collections\",\"version\":\"v1.5.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/collections.git\",\"reference\":\"a01ee38fcd999f34d9bfbcee59dbda5105449cbf\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/collections/zipball/a01ee38fcd999f34d9bfbcee59dbda5105449cbf\",\"reference\":\"a01ee38fcd999f34d9bfbcee59dbda5105449cbf\",\"shasum\":\"\"},\"require\":{\"php\":\"^7.1\"},\"require-dev\":{\"doctrine/coding-standard\":\"~0.1@dev\",\"phpunit/phpunit\":\"^5.7\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.3.x-dev\"}},\"autoload\":{\"psr-0\":{\"Doctrine\\Common\\Collections\\\":\"lib/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Benjamin Eberlei\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Jonathan Wage\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Collections Abstraction library\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"array\",\"collections\",\"iterator\"],\"time\":\"2017-07-22T10:37:32+00:00\"},{\"name\":\"doctrine/common\",\"version\":\"v2.5.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/common.git\",\"reference\":\"cd8daf2501e10c63dced7b8b9b905844316ae9d3\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/common/zipball/cd8daf2501e10c63dced7b8b9b905844316ae9d3\",\"reference\":\"cd8daf2501e10c63dced7b8b9b905844316ae9d3\",\"shasum\":\"\"},\"require\":{\"doctrine/annotations\":\"1.*\",\"doctrine/cache\":\"1.*\",\"doctrine/collections\":\"1.*\",\"doctrine/inflector\":\"1.*\",\"doctrine/lexer\":\"1.*\",\"php\":\">=5.3.2\"},\"require-dev\":{\"phpunit/phpunit\":\"~3.7\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"2.6.x-dev\"}},\"autoload\":{\"psr-0\":{\"Doctrine\\Common\\\":\"lib/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Benjamin Eberlei\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Jonathan Wage\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Common Library for Doctrine projects\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"annotations\",\"collections\",\"eventmanager\",\"persistence\",\"spl\"],\"time\":\"2015-04-02T19:55:44+00:00\"},{\"name\":\"doctrine/inflector\",\"version\":\"v1.2.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/inflector.git\",\"reference\":\"e11d84c6e018beedd929cff5220969a3c6d1d462\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/inflector/zipball/e11d84c6e018beedd929cff5220969a3c6d1d462\",\"reference\":\"e11d84c6e018beedd929cff5220969a3c6d1d462\",\"shasum\":\"\"},\"require\":{\"php\":\"^7.0\"},\"require-dev\":{\"phpunit/phpunit\":\"^6.2\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.2.x-dev\"}},\"autoload\":{\"psr-4\":{\"Doctrine\\Common\\Inflector\\\":\"lib/Doctrine/Common/Inflector\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Benjamin Eberlei\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Jonathan Wage\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Common String Manipulations with regard to casing and singular/plural rules.\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"inflection\",\"pluralize\",\"singularize\",\"string\"],\"time\":\"2017-07-22T12:18:28+00:00\"},{\"name\":\"doctrine/lexer\",\"version\":\"v1.0.1\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/doctrine/lexer.git\",\"reference\":\"83893c552fd2045dd78aef794c31e694c37c0b8c\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/doctrine/lexer/zipball/83893c552fd2045dd78aef794c31e694c37c0b8c\",\"reference\":\"83893c552fd2045dd78aef794c31e694c37c0b8c\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.3.2\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.0.x-dev\"}},\"autoload\":{\"psr-0\":{\"Doctrine\\Common\\Lexer\\\":\"lib/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Roman Borschel\",\"email\":\"[email protected]\"},{\"name\":\"Guilherme Blanco\",\"email\":\"[email protected]\"},{\"name\":\"Johannes Schmitt\",\"email\":\"[email protected]\"}],\"description\":\"Base library for a lexer that can be used in Top-Down, Recursive Descent Parsers.\",\"homepage\":\"http://www.doctrine-project.org\",\"keywords\":[\"lexer\",\"parser\"],\"time\":\"2014-09-09T13:34:57+00:00\"},{\"name\":\"guzzlehttp/guzzle\",\"version\":\"6.3.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/guzzle/guzzle.git\",\"reference\":\"f4db5a78a5ea468d4831de7f0bf9d9415e348699\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/guzzle/guzzle/zipball/f4db5a78a5ea468d4831de7f0bf9d9415e348699\",\"reference\":\"f4db5a78a5ea468d4831de7f0bf9d9415e348699\",\"shasum\":\"\"},\"require\":{\"guzzlehttp/promises\":\"^1.0\",\"guzzlehttp/psr7\":\"^1.4\",\"php\":\">=5.5\"},\"require-dev\":{\"ext-curl\":\"*\",\"phpunit/phpunit\":\"^4.0 || ^5.0\",\"psr/log\":\"^1.0\"},\"suggest\":{\"psr/log\":\"Required for using the Log middleware\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"6.2-dev\"}},\"autoload\":{\"files\":[\"src/functions_include.php\"],\"psr-4\":{\"GuzzleHttp\\\":\"src/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Michael Dowling\",\"email\":\"[email protected]\",\"homepage\":\"https://github.com/mtdowling\"}],\"description\":\"Guzzle is a PHP HTTP client library\",\"homepage\":\"http://guzzlephp.org/\",\"keywords\":[\"client\",\"curl\",\"framework\",\"http\",\"http client\",\"rest\",\"web service\"],\"time\":\"2017-06-22T18:50:49+00:00\"},{\"name\":\"guzzlehttp/promises\",\"version\":\"v1.3.1\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/guzzle/promises.git\",\"reference\":\"a59da6cf61d80060647ff4d3eb2c03a2bc694646\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/guzzle/promises/zipball/a59da6cf61d80060647ff4d3eb2c03a2bc694646\",\"reference\":\"a59da6cf61d80060647ff4d3eb2c03a2bc694646\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.5.0\"},\"require-dev\":{\"phpunit/phpunit\":\"^4.0\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.4-dev\"}},\"autoload\":{\"psr-4\":{\"GuzzleHttp\\Promise\\\":\"src/\"},\"files\":[\"src/functions_include.php\"]},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Michael Dowling\",\"email\":\"[email protected]\",\"homepage\":\"https://github.com/mtdowling\"}],\"description\":\"Guzzle promises library\",\"keywords\":[\"promise\"],\"time\":\"2016-12-20T10:07:11+00:00\"},{\"name\":\"guzzlehttp/psr7\",\"version\":\"1.4.2\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/guzzle/psr7.git\",\"reference\":\"f5b8a8512e2b58b0071a7280e39f14f72e05d87c\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c\",\"reference\":\"f5b8a8512e2b58b0071a7280e39f14f72e05d87c\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.4.0\",\"psr/http-message\":\"~1.0\"},\"provide\":{\"psr/http-message-implementation\":\"1.0\"},\"require-dev\":{\"phpunit/phpunit\":\"~4.0\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.4-dev\"}},\"autoload\":{\"psr-4\":{\"GuzzleHttp\\Psr7\\\":\"src/\"},\"files\":[\"src/functions_include.php\"]},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Michael Dowling\",\"email\":\"[email protected]\",\"homepage\":\"https://github.com/mtdowling\"},{\"name\":\"Tobias Schultze\",\"homepage\":\"https://github.com/Tobion\"}],\"description\":\"PSR-7 message implementation that also provides common utility methods\",\"keywords\":[\"http\",\"message\",\"request\",\"response\",\"stream\",\"uri\",\"url\"],\"time\":\"2017-03-20T17:10:46+00:00\"},{\"name\":\"mtdowling/jmespath.php\",\"version\":\"2.4.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/jmespath/jmespath.php.git\",\"reference\":\"adcc9531682cf87dfda21e1fd5d0e7a41d292fac\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/jmespath/jmespath.php/zipball/adcc9531682cf87dfda21e1fd5d0e7a41d292fac\",\"reference\":\"adcc9531682cf87dfda21e1fd5d0e7a41d292fac\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.4.0\"},\"require-dev\":{\"phpunit/phpunit\":\"~4.0\"},\"bin\":[\"bin/jp.php\"],\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"2.0-dev\"}},\"autoload\":{\"psr-4\":{\"JmesPath\\\":\"src/\"},\"files\":[\"src/JmesPath.php\"]},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Michael Dowling\",\"email\":\"[email protected]\",\"homepage\":\"https://github.com/mtdowling\"}],\"description\":\"Declaratively specify how to extract elements from a JSON document\",\"keywords\":[\"json\",\"jsonpath\"],\"time\":\"2016-12-03T22:08:25+00:00\"},{\"name\":\"psr/http-message\",\"version\":\"1.0.1\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/php-fig/http-message.git\",\"reference\":\"f6561bf28d520154e4b0ec72be95418abe6d9363\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363\",\"reference\":\"f6561bf28d520154e4b0ec72be95418abe6d9363\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.3.0\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.0.x-dev\"}},\"autoload\":{\"psr-4\":{\"Psr\\Http\\Message\\\":\"src/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"PHP-FIG\",\"homepage\":\"http://www.php-fig.org/\"}],\"description\":\"Common interface for HTTP messages\",\"homepage\":\"https://github.com/php-fig/http-message\",\"keywords\":[\"http\",\"http-message\",\"psr\",\"psr-7\",\"request\",\"response\"],\"time\":\"2016-08-06T14:39:51+00:00\"},{\"name\":\"psr/log\",\"version\":\"1.0.2\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/php-fig/log.git\",\"reference\":\"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/php-fig/log/zipball/4ebe3a8bf773a19edfe0a84b6585ba3d401b724d\",\"reference\":\"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.3.0\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.0.x-dev\"}},\"autoload\":{\"psr-4\":{\"Psr\\Log\\\":\"Psr/Log/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"PHP-FIG\",\"homepage\":\"http://www.php-fig.org/\"}],\"description\":\"Common interface for logging libraries\",\"homepage\":\"https://github.com/php-fig/log\",\"keywords\":[\"log\",\"psr\",\"psr-3\"],\"time\":\"2016-10-10T12:19:37+00:00\"},{\"name\":\"symfony/icu\",\"version\":\"v1.2.2\",\"target-dir\":\"Symfony/Component/Icu\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/symfony/icu.git\",\"reference\":\"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/symfony/icu/zipball/d4d85d6055b87f394d941b45ddd3a9173e1e3d2a\",\"reference\":\"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a\",\"shasum\":\"\"},\"require\":{\"ext-intl\":\"*\",\"lib-icu\":\">=4.4\",\"php\":\">=5.3.3\",\"symfony/intl\":\"~2.3\"},\"type\":\"library\",\"autoload\":{\"psr-0\":{\"Symfony\\Component\\Icu\\\":\"\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Symfony Community\",\"homepage\":\"http://symfony.com/contributors\"},{\"name\":\"Bernhard Schussek\",\"email\":\"[email protected]\"}],\"description\":\"Contains an excerpt of the ICU data and classes to load it.\",\"homepage\":\"http://symfony.com\",\"keywords\":[\"icu\",\"intl\"],\"abandoned\":\"symfony/intl\",\"time\":\"2014-07-25T09:58:17+00:00\"},{\"name\":\"symfony/symfony\",\"version\":\"v2.3.1\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/symfony/symfony.git\",\"reference\":\"0902c606b4df1161f5b786ae89f37b71380b1f23\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/symfony/symfony/zipball/0902c606b4df1161f5b786ae89f37b71380b1f23\",\"reference\":\"0902c606b4df1161f5b786ae89f37b71380b1f23\",\"shasum\":\"\"},\"require\":{\"doctrine/common\":\"~2.2\",\"php\":\">=5.3.3\",\"psr/log\":\"~1.0\",\"symfony/icu\":\"~1.0\",\"twig/twig\":\"~1.11\"},\"replace\":{\"symfony/browser-kit\":\"self.version\",\"symfony/class-loader\":\"self.version\",\"symfony/config\":\"self.version\",\"symfony/console\":\"self.version\",\"symfony/css-selector\":\"self.version\",\"symfony/debug\":\"self.version\",\"symfony/dependency-injection\":\"self.version\",\"symfony/doctrine-bridge\":\"self.version\",\"symfony/dom-crawler\":\"self.version\",\"symfony/event-dispatcher\":\"self.version\",\"symfony/filesystem\":\"self.version\",\"symfony/finder\":\"self.version\",\"symfony/form\":\"self.version\",\"symfony/framework-bundle\":\"self.version\",\"symfony/http-foundation\":\"self.version\",\"symfony/http-kernel\":\"self.version\",\"symfony/intl\":\"self.version\",\"symfony/locale\":\"self.version\",\"symfony/monolog-bridge\":\"self.version\",\"symfony/options-resolver\":\"self.version\",\"symfony/process\":\"self.version\",\"symfony/propel1-bridge\":\"self.version\",\"symfony/property-access\":\"self.version\",\"symfony/proxy-manager-bridge\":\"self.version\",\"symfony/routing\":\"self.version\",\"symfony/security\":\"self.version\",\"symfony/security-bundle\":\"self.version\",\"symfony/serializer\":\"self.version\",\"symfony/stopwatch\":\"self.version\",\"symfony/swiftmailer-bridge\":\"self.version\",\"symfony/templating\":\"self.version\",\"symfony/translation\":\"self.version\",\"symfony/twig-bridge\":\"self.version\",\"symfony/twig-bundle\":\"self.version\",\"symfony/validator\":\"self.version\",\"symfony/web-profiler-bundle\":\"self.version\",\"symfony/yaml\":\"self.version\"},\"require-dev\":{\"doctrine/data-fixtures\":\"1.0.*\",\"doctrine/dbal\":\"~2.2\",\"doctrine/orm\":\"~2.2,>=2.2.3\",\"ircmaxell/password-compat\":\"1.0.*\",\"monolog/monolog\":\"~1.3\",\"ocramius/proxy-manager\":\">=0.3.1,<0.4-dev\",\"propel/propel1\":\"1.6.*\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"2.3-dev\"}},\"autoload\":{\"psr-0\":{\"Symfony\\\":\"src/\"},\"classmap\":[\"src/Symfony/Component/HttpFoundation/Resources/stubs\",\"src/Symfony/Component/Intl/Resources/stubs\"],\"files\":[\"src/Symfony/Component/Intl/Resources/stubs/functions.php\"]},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"MIT\"],\"authors\":[{\"name\":\"Symfony Community\",\"homepage\":\"http://symfony.com/contributors\"},{\"name\":\"Fabien Potencier\",\"email\":\"[email protected]\"}],\"description\":\"The Symfony PHP framework\",\"homepage\":\"http://symfony.com\",\"keywords\":[\"framework\"],\"time\":\"2013-06-11T11:46:38+00:00\"},{\"name\":\"twig/twig\",\"version\":\"v1.35.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/twigphp/Twig.git\",\"reference\":\"daa657073e55b0a78cce8fdd22682fddecc6385f\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/twigphp/Twig/zipball/daa657073e55b0a78cce8fdd22682fddecc6385f\",\"reference\":\"daa657073e55b0a78cce8fdd22682fddecc6385f\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.3.3\"},\"require-dev\":{\"psr/container\":\"^1.0\",\"symfony/debug\":\"~2.7\",\"symfony/phpunit-bridge\":\"~3.3@dev\"},\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"1.35-dev\"}},\"autoload\":{\"psr-0\":{\"Twig_\":\"lib/\"},\"psr-4\":{\"Twig\\\":\"src/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"BSD-3-Clause\"],\"authors\":[{\"name\":\"Fabien Potencier\",\"email\":\"[email protected]\",\"homepage\":\"http://fabien.potencier.org\",\"role\":\"Lead Developer\"},{\"name\":\"Armin Ronacher\",\"email\":\"[email protected]\",\"role\":\"Project Founder\"},{\"name\":\"Twig Team\",\"homepage\":\"http://twig.sensiolabs.org/contributors\",\"role\":\"Contributors\"}],\"description\":\"Twig, the flexible, fast, and secure template language for PHP\",\"homepage\":\"http://twig.sensiolabs.org\",\"keywords\":[\"templating\"],\"time\":\"2017-09-27T18:06:46+00:00\"},{\"name\":\"yiisoft/yii\",\"version\":\"1.1.14\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/yiisoft/yii.git\",\"reference\":\"f0fee98ee84f70f1f3652f65562c9670e919cb4e\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/yiisoft/yii/zipball/f0fee98ee84f70f1f3652f65562c9670e919cb4e\",\"reference\":\"f0fee98ee84f70f1f3652f65562c9670e919cb4e\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.1.0\"},\"bin\":[\"framework/yiic\"],\"type\":\"library\",\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"BSD-3-Clause\"],\"authors\":[{\"name\":\"Qiang Xue\",\"email\":\"[email protected]\",\"homepage\":\"http://www.yiiframework.com/\",\"role\":\"Founder and project lead\"},{\"name\":\"Alexander Makarov\",\"email\":\"[email protected]\",\"homepage\":\"http://rmcreative.ru/\",\"role\":\"Core framework development\"},{\"name\":\"Maurizio Domba\",\"homepage\":\"http://mdomba.info/\",\"role\":\"Core framework development\"},{\"name\":\"Carsten Brandt\",\"email\":\"[email protected]\",\"homepage\":\"http://cebe.cc/\",\"role\":\"Core framework development\"},{\"name\":\"Wei Zhuo\",\"email\":\"[email protected]\",\"role\":\"Project site maintenance and development\"},{\"name\":\"Sebastián Thierer\",\"email\":\"[email protected]\",\"role\":\"Component development\"},{\"name\":\"Jeffrey Winesett\",\"email\":\"[email protected]\",\"role\":\"Documentation and marketing\"},{\"name\":\"Timur Ruziev\",\"email\":\"[email protected]\",\"homepage\":\"http://resurtm.com/\",\"role\":\"Core framework development\"},{\"name\":\"Paul Klimov\",\"email\":\"[email protected]\",\"role\":\"Core framework development\"}],\"description\":\"Yii Web Programming Framework\",\"homepage\":\"http://www.yiiframework.com/\",\"keywords\":[\"framework\",\"yii\"],\"time\":\"2013-08-12T00:12:08+00:00\"},{\"name\":\"zendframework/zendframework\",\"version\":\"2.1.0\",\"source\":{\"type\":\"git\",\"url\":\"https://github.com/zendframework/zendframework.git\",\"reference\":\"345a8cbedbe8de8a25bf18579fe54d169ac5075a\"},\"dist\":{\"type\":\"zip\",\"url\":\"https://api.github.com/repos/zendframework/zendframework/zipball/345a8cbedbe8de8a25bf18579fe54d169ac5075a\",\"reference\":\"345a8cbedbe8de8a25bf18579fe54d169ac5075a\",\"shasum\":\"\"},\"require\":{\"php\":\">=5.3.3\"},\"replace\":{\"zendframework/zend-authentication\":\"self.version\",\"zendframework/zend-barcode\":\"self.version\",\"zendframework/zend-cache\":\"self.version\",\"zendframework/zend-captcha\":\"self.version\",\"zendframework/zend-code\":\"self.version\",\"zendframework/zend-config\":\"self.version\",\"zendframework/zend-console\":\"self.version\",\"zendframework/zend-crypt\":\"self.version\",\"zendframework/zend-db\":\"self.version\",\"zendframework/zend-debug\":\"self.version\",\"zendframework/zend-di\":\"self.version\",\"zendframework/zend-dom\":\"self.version\",\"zendframework/zend-escaper\":\"self.version\",\"zendframework/zend-eventmanager\":\"self.version\",\"zendframework/zend-feed\":\"self.version\",\"zendframework/zend-file\":\"self.version\",\"zendframework/zend-filter\":\"self.version\",\"zendframework/zend-form\":\"self.version\",\"zendframework/zend-http\":\"self.version\",\"zendframework/zend-i18n\":\"self.version\",\"zendframework/zend-inputfilter\":\"self.version\",\"zendframework/zend-json\":\"self.version\",\"zendframework/zend-ldap\":\"self.version\",\"zendframework/zend-loader\":\"self.version\",\"zendframework/zend-log\":\"self.version\",\"zendframework/zend-mail\":\"self.version\",\"zendframework/zend-math\":\"self.version\",\"zendframework/zend-memory\":\"self.version\",\"zendframework/zend-mime\":\"self.version\",\"zendframework/zend-modulemanager\":\"self.version\",\"zendframework/zend-mvc\":\"self.version\",\"zendframework/zend-navigation\":\"self.version\",\"zendframework/zend-paginator\":\"self.version\",\"zendframework/zend-permissions-acl\":\"self.version\",\"zendframework/zend-permissions-rbac\":\"self.version\",\"zendframework/zend-progressbar\":\"self.version\",\"zendframework/zend-serializer\":\"self.version\",\"zendframework/zend-server\":\"self.version\",\"zendframework/zend-servicemanager\":\"self.version\",\"zendframework/zend-session\":\"self.version\",\"zendframework/zend-soap\":\"self.version\",\"zendframework/zend-stdlib\":\"self.version\",\"zendframework/zend-tag\":\"self.version\",\"zendframework/zend-test\":\"self.version\",\"zendframework/zend-text\":\"self.version\",\"zendframework/zend-uri\":\"self.version\",\"zendframework/zend-validator\":\"self.version\",\"zendframework/zend-version\":\"self.version\",\"zendframework/zend-view\":\"self.version\",\"zendframework/zend-xmlrpc\":\"self.version\"},\"require-dev\":{\"doctrine/common\":\">=2.1\",\"phpunit/phpunit\":\"3.7.*\"},\"suggest\":{\"doctrine/common\":\"Doctrine\\Common >=2.1 for annotation features\",\"ext-intl\":\"ext/intl for i18n features\",\"pecl-weakref\":\"Implementation of weak references for Zend\\Stdlib\\CallbackHandler\",\"zendframework/zendpdf\":\"ZendPdf for creating PDF representations of barcodes\",\"zendframework/zendservice-recaptcha\":\"ZendService\\ReCaptcha for rendering ReCaptchas in Zend\\Captcha and/or Zend\\Form\"},\"bin\":[\"bin/classmap_generator.php\"],\"type\":\"library\",\"extra\":{\"branch-alias\":{\"dev-master\":\"2.1-dev\",\"dev-develop\":\"2.2-dev\"}},\"autoload\":{\"psr-0\":{\"Zend\\\":\"library/\",\"ZendTest\\\":\"tests/\"}},\"notification-url\":\"https://packagist.org/downloads/\",\"license\":[\"BSD-3-Clause\"],\"description\":\"Zend Framework 2\",\"homepage\":\"http://framework.zend.com/\",\"keywords\":[\"framework\",\"zf2\"],\"time\":\"2013-01-30T16:46:21+00:00\"}],\"packages-dev\":[],\"aliases\":[],\"minimum-stability\":\"stable\",\"stability-flags\":[],\"prefer-stable\":false,\"prefer-lowest\":false,\"platform\":{\"php\":\">=5.3.2\"},\"platform-dev\":[]}"
}
]
}
}
{
"ok": false,
"issues": {
"vulnerabilities": [
{
"id": "SNYK-PHP-AWSAWSSDKPHP-70003",
"url": "https://snyk.io/vuln/SNYK-PHP-AWSAWSSDKPHP-70003",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\n Affected versions of [`aws/aws-sdk-php`](https://packagist.org/packages/aws/aws-sdk-php) are vulnerable to Arbitrary Code Execution.\n\nDoctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.\n\n## Remediation\nUpgrade `aws/aws-sdk-php` to version 3.2.1 or higher.\n\n## References\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-5723)\n- [Github ChangeLog](https://github.com/aws/aws-sdk-php/blob/master/CHANGELOG.md#321---2015-07-23)\n",
"functions": [],
"from": [
"aws/[email protected]"
],
"package": "aws/aws-sdk-php",
"version": "3.0.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<3.2.1"
]
},
"publicationTime": "2015-07-24T00:41:41Z",
"disclosureTime": "2015-07-24T00:41:41Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-5723"
],
"CWE": [
"CWE-264"
]
},
"credit": [
"Ryan Lane"
],
"CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 7.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-DOCTRINECOMMON-70024",
"url": "https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\nAffected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.\n\nDoctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.\n\n## Remediation\nUpgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.\n\n## References\n- [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)\n",
"functions": [],
"from": [
"doctrine/[email protected]"
],
"package": "doctrine/common",
"version": "2.5.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.3",
">=2.5.0, <2.5.1"
]
},
"publicationTime": "2015-08-31T14:42:59Z",
"disclosureTime": "2015-08-31T14:42:59Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-5723"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Ryan Lane"
],
"CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 7.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-DOCTRINECOMMON-70024",
"url": "https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\nAffected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.\n\nDoctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.\n\n## Remediation\nUpgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.\n\n## References\n- [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)\n",
"functions": [],
"from": [
"symfony/[email protected]",
"doctrine/[email protected]"
],
"package": "doctrine/common",
"version": "2.5.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.3",
">=2.5.0, <2.5.1"
]
},
"publicationTime": "2015-08-31T14:42:59Z",
"disclosureTime": "2015-08-31T14:42:59Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-5723"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Ryan Lane"
],
"CVSSv3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 7.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-173743",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173743",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS).\nA remote attacker could inject arbitrary web script or HTML via the \"file\" parameter in a URL.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 4.1 or higher.\n\n\n## References\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12040)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<4.1"
]
},
"publicationTime": "2018-06-14T00:35:49Z",
"disclosureTime": "2018-06-08T00:35:49Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-12040"
],
"CWE": [
"CWE-79"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-173744",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173744",
"title": "Host Header Injection",
"type": "vuln",
"description": "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Host Header Injection.\nWhen using `HttpCache`, the values of the `X-Forwarded-Host` headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.2 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a)\n\n- [GitHub Release Tag 4.1.3](https://github.com/symfony/symfony/releases/tag/v4.1.3)\n\n- [Symphony Security Blog](https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.49",
">=2.8.0, <2.8.44",
">=3.3.0, <3.3.18",
">=3.4.0, <3.4.14",
">=4.0.0, <4.0.14",
">=4.1.0, <4.1.2"
]
},
"publicationTime": "2018-08-05T13:44:27Z",
"disclosureTime": "2018-07-31T17:24:43Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-14774"
],
"CWE": [
"CWE-444"
]
},
"credit": [
"Chaosversum"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"cvssScore": 7.2,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-173745",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173745",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS)\nvia the content page.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 2.7.7 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/symphonycms/symphony-2/commit/1ace6b31867cc83267b3550686271c9c65ac3ec0)\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12043)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.7"
]
},
"publicationTime": "2018-06-13T10:56:51Z",
"disclosureTime": "2018-06-07T21:05:47Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-12043"
],
"CWE": [
"CWE-79"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70207",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70207",
"title": "Loss of Information",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Loss of Information.\n\nWhen using the Validator component, if Symfony\\\\Component\\\\Validator\\\\Mapping\\\\Cache\\\\ApcCache is enabled (or any other cache implementing Symfony\\\\Component\\\\Validator\\\\Mapping\\\\Cache\\\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "low",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.3",
">=2.1.0, <2.1.12",
">=2.2.0, <2.2.5",
">=2, <2.0.24"
]
},
"publicationTime": "2013-08-17T07:55:32Z",
"disclosureTime": "2013-08-17T07:55:32Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2013-4751"
],
"CWE": [
"CWE-221"
]
},
"credit": [
"Alexandre Salome"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 3.7,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70208",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70208",
"title": "HTTP Host Header Poisoning",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to HTTP Host Header Poisoning.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.3",
">=2.1.0, <2.1.12",
">=2.2.0, <2.2.5",
">=2, <2.0.24"
]
},
"publicationTime": "2013-08-17T09:14:49Z",
"disclosureTime": "2013-08-17T09:14:49Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2013-4752"
],
"CWE": [
"CWE-74"
]
},
"credit": [
"Jordan Alliot"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"cvssScore": 8.2,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70209",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70209",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).\n\nThe Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to [CVE-2013-5750](https://snyk.io/vuln/SNYK-PHP-FRIENDSOFSYMFONYUSERBUNDLE-70102).\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\n\nTwo common types of DoS vulnerabilities:\n\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.6, 2.1.13, 2.2.9, 2.0.25 or higher.\n\n## References\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-5958)\n- [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2, <2.0.25",
">=2.1.0, <2.1.13",
">=2.2.0, <2.2.9",
">=2.3.0, <2.3.6"
]
},
"publicationTime": "2013-10-10T08:30:51Z",
"disclosureTime": "2013-10-10T08:30:51Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2013-5958"
],
"CWE": [
"CWE-400"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70210",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70210",
"title": "Arbitrary Code Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released)\n- [GitHub Commit](https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.19",
">=2.1.0, <2.2.0",
">=2.4.0, <2.4.9",
">=2.5.0, <2.5.4",
">=2.2.0, <2.3.0",
">=2, <2.1.0"
]
},
"publicationTime": "2014-07-25T22:18:02Z",
"disclosureTime": "2014-07-25T22:18:02Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-4931"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Jeremy Derussé"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 5.6,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70211",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70211",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\n\nTwo common types of DoS vulnerabilities:\n\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.19, 2.4.9, 2.5.4 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header)\n- [GitHub PR](https://github.com/symfony/symfony/pull/11828)\n- [GitHub Commit](https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2, <2.3.19",
">=2.4.0, <2.4.9",
">=2.5.0, <2.5.4"
]
},
"publicationTime": "2014-09-03T07:37:21Z",
"disclosureTime": "2014-09-03T07:37:21Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-5244"
],
"CWE": [
"CWE-400"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70212",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70212",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Information Exposure.\n\nWhen you enable the ESI feature and when you are using a proxy like Varnish that you configured as a trusted proxy, the FragmentHandler considered requests to render fragments as coming from a trusted source, even if the client was requesting them directly. Symfony can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2014-5245-direct-access-of-esi-urls-behind-a-trusted-proxy)\n- [GitHub PR](https://github.com/symfony/symfony/pull/11831)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "low",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.19",
">=2.1.0, <2.2.0",
">=2.4.0, <2.4.9",
">=2.5.0, <2.5.4",
">=2.2.0, <2.3.0",
">=2, <2.1.0"
]
},
"publicationTime": "2014-09-03T07:40:02Z",
"disclosureTime": "2014-09-03T07:40:02Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-5245"
],
"CWE": [
"CWE-200"
]
},
"credit": [
"Cédric Nirousset",
"Trent Steel",
"Christophe Coevoet"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 3.7,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70213",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70213",
"title": "Authentication Bypass",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Authentication Bypass.\n\nWhen an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2014-6061-security-issue-when-parsing-the-authorization-header)\n- [GitHub Issue](https://github.com/symfony/symfony/pull/11829)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "low",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.19",
">=2.1.0, <2.2.0",
">=2.4.0, <2.4.9",
">=2.5.0, <2.5.4",
">=2.2.0, <2.3.0",
">=2, <2.1.0"
]
},
"publicationTime": "2014-09-03T07:38:23Z",
"disclosureTime": "2014-09-03T07:38:23Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-6061"
],
"CWE": [
"CWE-592"
]
},
"credit": [
"Damien Tournoud"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 3.7,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70214",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70214",
"title": "Cross-site Request Forgery (CSRF)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Cross-site Request Forgery (CSRF).\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2014-6072-csrf-vulnerability-in-the-web-profiler)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.19",
">=2.1.0, <2.2.0",
">=2.4.0, <2.4.9",
">=2.5.0, <2.5.4",
">=2.2.0, <2.3.0",
">=2, <2.1.0"
]
},
"publicationTime": "2014-09-03T07:40:30Z",
"disclosureTime": "2014-09-03T07:40:30Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-6072"
],
"CWE": [
"CWE-352"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70215",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70215",
"title": "Arbitrary Code Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.\n\nEval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a `language=\"php\"` attribute of a SCRIPT element.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.27, 2.6.6, 2.2.0, 2.5.0, 2.5.11, 2.3.0, 2.1.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2015-2308-esi-code-injection)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.27",
">=2.6.0, <2.6.6",
">=2.1.0, <2.2.0",
">=2.4.0, <2.5.0",
">=2.5.0, <2.5.11",
">=2.2.0, <2.3.0",
">=2, <2.1.0"
]
},
"publicationTime": "2015-04-01T18:55:26Z",
"disclosureTime": "2015-04-01T18:55:26Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-2308"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70216",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70216",
"title": "Man-in-the-Middle (MitM)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Man-in-the-Middle (MitM).\n\nThe `Symfony\\Component\\HttpFoundation\\Request` class provides a mechanism that ensures it does not trust HTTP header values coming from a \"non-trusted\" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.27, 2.5.11, 2.6.6 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2015-2309-unsafe-methods-in-the-request-class)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2, <2.3.27",
">=2.4.0, <2.5.11",
">=2.6.0, <2.6.6"
]
},
"publicationTime": "2015-04-01T18:55:26Z",
"disclosureTime": "2015-04-01T18:55:26Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-2309"
],
"CWE": [
"CWE-300"
]
},
"credit": [
"Dmitrii Chekaliuk"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssScore": 6.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70218",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70218",
"title": "Session Fixation",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Session Fixation.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.35",
">=2.6.0, <2.6.12",
">=2.4.0, <2.5.0",
">=2.7.0, <2.7.7",
">=2.5.0, <2.6.0"
]
},
"publicationTime": "2015-11-23T11:45:06Z",
"disclosureTime": "2015-11-23T11:45:06Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-8124"
],
"CWE": [
"CWE-384"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70219",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70219",
"title": "Timing Attack",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Timing Attack.\n\nSymfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving:\n* Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or\n* Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or\n* legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.35",
">=2.6.0, <2.6.12",
">=2.4.0, <2.5.0",
">=2.7.0, <2.7.7",
">=2.5.0, <2.6.0"
]
},
"publicationTime": "2015-11-23T11:45:06Z",
"disclosureTime": "2015-11-23T11:45:06Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-8125"
],
"CWE": [
"CWE-208"
]
},
"credit": [
"Sebastiaan Stok"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70220",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70220",
"title": "Insecure Randomness",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Insecure Randomness .\n\nThe nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.37, 2.6.13, 2.5.0, 2.7.9, 2.6.0 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.37",
">=2.6.0, <2.6.13",
">=2.4.0, <2.5.0",
">=2.7.0, <2.7.9",
">=2.5.0, <2.6.0"
]
},
"publicationTime": "2016-01-14T09:59:32Z",
"disclosureTime": "2016-01-14T09:59:32Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2016-1902"
],
"CWE": [
"CWE-330"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssScore": 7.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-70222",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70222",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).\n\nThe attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\n\nTwo common types of DoS vulnerabilities:\n\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `symfony/symfony` to version 2.3.41, 2.7.0, 2.5.0, 2.7.13, 2.6.0, 2.8.6, 3.0.6 or higher.\n\n## References\n- [Symfony Release Notes](http://symfony.com/blog/cve-2016-4423-large-username-storage-in-session)\n- [GitHub PR](https://github.com/symfony/symfony/pull/18733)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.41",
">=2.6.0, <2.7.0",
">=2.4.0, <2.5.0",
">=2.7.0, <2.7.13",
">=2.5.0, <2.6.0",
">=2.8.0, <2.8.6",
">=3, <3.0.6"
]
},
"publicationTime": "2016-05-09T21:31:02Z",
"disclosureTime": "2016-05-09T21:31:02Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2016-4423"
],
"CWE": [
"CWE-400"
]
},
"credit": [
"Marek Alaksa"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssScore": 7.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72196",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72196",
"title": "Denial of Service (DoS)",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) attacks via the `PDOSessionHandler` class.\n\n**An application is vulnerable when:**\n\n* It uses `PDOSessionHandler` to store its sessions\n* And it uses MySQL as a backend for sessions managed by `PDOSessionHandler`\n* And the SQL mode does not contain `STRICT_ALL_TABLES` or `STRICT_TRANS_TABLES`.\n\nWith this configuration, An attacker may conduct a denial of service by a well-crafted session, which leads to an infinite loop in the code.\n\n## Details\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\n\nTwo common types of DoS vulnerabilities:\n\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](npm:ws:20171108)\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.\n\n## References\n- [Symphony Security Advisory](https://symfony.com/cve-2018-11386)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.48",
">=2.8.0, <2.8.41",
">=3.0.0, <3.3.17",
">=3.4.0, <3.4.11",
">=4.0.0, <4.0.11"
]
},
"publicationTime": "2018-05-30T11:36:38.154000Z",
"disclosureTime": "2018-05-30T03:25:45.531000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-11386"
],
"CWE": [
"CWE-835"
]
},
"credit": [
"Federico Stange"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssScore": 5.9,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72197",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72197",
"title": "Access Restriction Bypass",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of PHP components.\n\nAffected versions of this package are vulnerable to Access Restriction Bypass. A misconfigured LDAP server allowed unauthorized access, due to a missing check for `null` passwords.\n\n**Note:** This is related to [CVE-2016-2403](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70221).\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.8.37, 3.3.17, 3.4.7, 4.0.7 or higher.\n\n## References\n- [Symphony Security Advisory](https://symfony.com/cve-2018-11407)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.8.37",
">=3.0.0, <3.3.17",
">=3.4.0, <3.4.7",
">=4.0.0, <4.0.7"
]
},
"publicationTime": "2018-05-30T11:36:38.236000Z",
"disclosureTime": "2018-05-30T03:25:45.532000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-11407"
],
"CWE": [
"CWE-284"
]
},
"credit": [
"Theo Bouge"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72198",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72198",
"title": "CSRF Token Fixation",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.\n\nAffected versions of this package are vulnerable to CSRF Token Fixation. CSRF tokens where not erased during logout, when the `invalidate_session` option was disabled. By default, a user’s session is invalidated when the user is logged out.\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.\n\n## References\n- [Symphony Security Advisory](https://symfony.com/cve-2018-11406)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.48",
">=2.8.0, <2.8.41",
">=3.0.0, <3.3.17",
">=3.4.0, <3.4.11",
">=4.0.0, <4.0.11"
]
},
"publicationTime": "2018-05-30T11:36:38.318000Z",
"disclosureTime": "2018-05-30T03:25:45.533000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-11406"
],
"CWE": [
"CWE-384"
]
},
"credit": [
"Kevin Liagre"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"cvssScore": 8.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72199",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72199",
"title": "Open Redirect",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.\n\nAffected versions of this package are vulnerable to Open Redirect. This is due to an incomplete fix for [CVE-2017-16652](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70381). There was an an edge case when the `security.http_utils` was inlined by the container.\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.\n\n## References\n- [Symphony Security Advisory](https://symfony.com/cve-2018-11408)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.48",
">=2.8.0, <2.8.41",
">=3.0.0, <3.3.17",
">=3.4.0, <3.4.11",
">=4.0.0, <4.0.11"
]
},
"publicationTime": "2018-05-30T11:36:38.403000Z",
"disclosureTime": "2018-05-30T03:25:45.535000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-11408"
],
"CWE": [
"CWE-601"
]
},
"credit": [
"Antal Aron"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72200",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72200",
"title": "Session Fixation",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.\n\nAffected versions of this package are vulnerable to Session Fixation via the `Guard` login feature. An attacker may be able to impersonate the victim towards the web application if the session id value was previously known to the attacker. This allows the attacker to access a Symfony web application with the attacked user's permissions.\n\n**Note:**\n* The `Guard authentication` login feature must be enabled for the attack to be applicable.\n* The attacker must have access to the `PHPSESSID` cookie value or has successfully set a new value in the user's browser.\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.\n\n## References\n- [Symphony Security Advisory](https://symfony.com/cve-2018-11385)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.48",
">=2.8.0, <2.8.41",
">=3.0.0, <3.3.17",
">=3.4.0, <3.4.11",
">=4.0.0, <4.0.11"
]
},
"publicationTime": "2018-05-30T11:36:38.526000Z",
"disclosureTime": "2018-05-30T03:25:45.536000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-11385"
],
"CWE": [
"CWE-384"
]
},
"credit": [
"Chris Wilkinson"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 8.1,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-SYMFONYSYMFONY-72246",
"url": "https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72246",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is the The Symfony PHP framework.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the `ExceptionHandler.php` method.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.33, 2.8.26, 3.2.13, 3.3.6 or higher.\n\n## References\n- [GitHub PR](https://github.com/symfony/symfony/pull/23684)\n- [GitHub Issue](https://github.com/symfony/symfony/issues/27987)\n",
"functions": [],
"from": [
"symfony/[email protected]"
],
"package": "symfony/symfony",
"version": "2.3.1",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.7.33",
">=2.8.0, <2.8.26",
">=3.0.0, <3.2.13",
">=3.3.0, <3.3.6"
]
},
"publicationTime": "2018-07-30T13:57:42.005000Z",
"disclosureTime": "2018-07-20T00:54:33.251000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2017-18343"
],
"CWE": [
"CWE-79"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cvssScore": 6.1,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-TWIGTWIG-173776",
"url": "https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-173776",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\n\n[twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.\n\n\nAffected versions of this package are vulnerable to Information Exposure\ndue to allowing the evaluation of non-trusted templates in a sandbox, where everything is forbidden if not explicitly allowed by a sandbox policy (tags, filters, functions, method calls, ...).\n\n\n*Note: If you are not using the sandbox, your code is not affected.*\n\n## Remediation\n\nUpgrade `twig/twig` to version 1.38.0, 2.7.0 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/twigphp/Twig/commit/0f3af98ef6e71929ad67fb6e5f3ad65777c1c4c5)\n\n- [Twig Security Advisory](https://symfony.com/blog/twig-sandbox-information-disclosure)\n",
"functions": [],
"from": [
"symfony/[email protected]",
"twig/[email protected]"
],
"package": "twig/twig",
"version": "1.35.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=1.0.0, <1.38.0",
">=2.0.0, <2.7.0"
]
},
"publicationTime": "2019-03-12T13:58:49Z",
"disclosureTime": "2019-03-12T13:58:49Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2019-9942"
],
"CWE": [
"CWE-200"
]
},
"credit": [
"Fabien Potencier"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/RL:O",
"cvssScore": 4.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-TWIGTWIG-72239",
"url": "https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-72239",
"title": "Server Side Template Injection (SSTI)",
"type": "vuln",
"description": "## Overview\n[twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.\n\nAffected versions of this package are vulnerable to Server Side Template Injection (SSTI) via the `search_key` parameter.\n\n## Remediation\nUpgrade `twig/twig` to version 2.4.4 or higher.\n\n## References\n- [Exploit-DB](https://www.exploit-db.com/exploits/44102/)\n- [GitHub Commit](https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb)\n- [GitHub ChangLog](https://github.com/twigphp/Twig/blob/2.x/CHANGELOG)\n",
"functions": [],
"from": [
"symfony/[email protected]",
"twig/[email protected]"
],
"package": "twig/twig",
"version": "1.35.0",
"severity": "critical",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.4"
]
},
"publicationTime": "2018-07-23T13:46:08.115000Z",
"disclosureTime": "2018-07-10T15:06:02.373000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2018-13818"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssScore": 9.8,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-YIISOFTYII-70295",
"url": "https://snyk.io/vuln/SNYK-PHP-YIISOFTYII-70295",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\nAffected versions of [`yiisoft/yii`](https://packagist.org/packages/yiisoft/yii) are vulnerable to Arbitrary Code Execution.\n\nThe CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.\n\n## Remediation\nUpgrade `yiisoft/yii` to version 1.1.15 or higher.\n\n## References\n- [Yii Framework Security Advisory](http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/)\n",
"functions": [],
"from": [
"yiisoft/[email protected]"
],
"package": "yiisoft/yii",
"version": "1.1.14",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<1.1.15"
]
},
"publicationTime": "2014-06-30T07:15:00Z",
"disclosureTime": "2014-06-30T07:15:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-4672"
],
"CWE": [
"CWE-94"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321",
"title": "Route Parameter Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Route Parameter Injection.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-01)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.1.0, <2.1.4",
">=2, <2.0.8"
]
},
"publicationTime": "2013-03-13T08:39:38Z",
"disclosureTime": "2013-03-13T08:39:38Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-74"
]
},
"credit": [
"codemagician"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"cvssScore": 6.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-02)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "low",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.1.0, <2.1.4",
">=2, <2.0.8"
]
},
"publicationTime": "2013-03-13T15:05:23Z",
"disclosureTime": "2013-03-13T15:05:23Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-200"
]
},
"credit": [
"Pádraic Brady"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 3.7,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323",
"title": "SQL Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection due to execution of platform-specific SQL containing interpolations.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-03)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.1.0, <2.1.4",
">=2, <2.0.8"
]
},
"publicationTime": "2013-03-13T15:04:50Z",
"disclosureTime": "2013-03-13T15:04:50Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-89"
]
},
"credit": [
"Axel Helmert"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324",
"title": "IP Spoofing",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential IP Spoofing.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.2.5 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-04)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.2.5"
]
},
"publicationTime": "2013-10-31T10:35:17Z",
"disclosureTime": "2013-10-31T10:35:17Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-290"
]
},
"credit": [
"Steve Talbot"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325",
"title": "XML External Entity (XXE) Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.\n\n## Details\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n\n <username>John</username>\n\n</xml>\n```\n\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of `/etc/passwd` and display it to the user rendered by `username`.\n\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n\n <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n\n <username>&xxe;</username>\n\n</xml>\n```\n\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.1.6, 2.2.6 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-01)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.1.0, <2.1.6",
">=2.2.0, <2.2.6"
]
},
"publicationTime": "2014-02-26T16:02:02Z",
"disclosureTime": "2014-02-26T16:02:02Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-611"
]
},
"credit": [
"Lukas Reschke"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326",
"title": "Cross-site Scripting (XSS)",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Cross-site Scripting (XSS).\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `<`; and `>` can be coded as `>`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.1, 2.2.7 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-03)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.1",
">=2, <2.2.7"
]
},
"publicationTime": "2014-02-26T16:02:02Z",
"disclosureTime": "2014-02-26T16:02:02Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-79"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cvssScore": 6.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327",
"title": "Authentication Bypass",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Authentication Bypass.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-05)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.3",
">=2, <2.2.8"
]
},
"publicationTime": "2014-09-16T22:00:00Z",
"disclosureTime": "2014-09-16T22:00:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-8088"
],
"CWE": [
"CWE-592"
]
},
"credit": [
"Matthew Daley"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328",
"title": "SQL Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection vector when manually quoting values for sqlsrv extension, using null byte.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-06)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.3",
">=2, <2.2.8"
]
},
"publicationTime": "2014-09-16T22:00:00Z",
"disclosureTime": "2014-09-16T22:00:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2014-8089"
],
"CWE": [
"CWE-89"
]
},
"credit": [
"Jonas Sandström"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329",
"title": "Insufficient Session Validation",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Insufficient Session Validation.\n\n`Zend\\Session` session validators do not work as expected if set prior to the start of a session.\n\nThe implication is that subsequent calls to `Zend\\Session\\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.\n\nAn attacker is thus able to simply ignore session validators such as `RemoteAddr` or `HttpUserAgent`, since the \"signature\" that these validators check against is not being stored in the session.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.4, 2.2.9 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-01)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.4",
">=2, <2.2.9"
]
},
"publicationTime": "2015-01-14T22:00:00Z",
"disclosureTime": "2015-01-14T22:00:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-284"
]
},
"credit": [
"Yuriy Dyachenko"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330",
"title": "SQL Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.5, 2.2.10 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-02)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2.3.0, <2.3.5",
">=2, <2.2.10"
]
},
"publicationTime": "2015-02-18T19:15:09Z",
"disclosureTime": "2015-02-18T19:15:09Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-0270"
],
"CWE": [
"CWE-89"
]
},
"credit": [
"Grigory Ivanov"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332",
"title": "CRLF Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential CRLF injection attacks in mail and HTTP headers.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.8, 2.4.1 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-04)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.3.8",
">=2.4.0, <2.4.1"
]
},
"publicationTime": "2015-05-07T08:53:42Z",
"disclosureTime": "2015-05-07T08:53:42Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-3154"
],
"CWE": [
"CWE-113"
]
},
"credit": [
"Filippo Tessarotto",
"Maks3w"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333",
"title": "XML External Entity (XXE) Injection",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.\n\n\n## Details\n\n\nXXE Injection is a type of attack against an application that parses XML input.\nXML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.\n\n\nAttacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.\n\n\nFor example, below is a sample XML document, containing an XML element- username.\n\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n\n <username>John</username>\n\n</xml>\n```\n\n\nAn external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of `/etc/passwd` and display it to the user rendered by `username`.\n\n\n```xml\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n<!DOCTYPE foo [\n\n <!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n\n <username>&xxe;</username>\n\n</xml>\n```\n\n\nOther XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.\n\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.4.6, 2.5.1 or higher.\n\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-06)",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "proof-of-concept",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.6",
">=2.5.0, <2.5.1"
]
},
"publicationTime": "2015-08-03T15:13:58Z",
"disclosureTime": "2015-08-03T15:13:58Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-5161"
],
"CWE": [
"CWE-611"
]
},
"credit": [
"Dawid Golunski"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R",
"cvssScore": 6.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.4.9 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-09)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "low",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.9"
]
},
"publicationTime": "2015-11-23T14:30:00Z",
"disclosureTime": "2015-11-23T14:30:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-200"
]
},
"credit": [
"Vincent Herbulot"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 3.7,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336",
"title": "Information Exposure",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.4.9 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-10)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
">=2, <2.4.9"
]
},
"publicationTime": "2015-11-23T14:30:00Z",
"disclosureTime": "2015-11-23T14:30:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [
"CVE-2015-7503"
],
"CWE": [
"CWE-200"
]
},
"credit": [
"Unknown"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssScore": 7.5,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337",
"title": "Arbitrary Code Execution",
"type": "vuln",
"description": "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Arbitrary Code Execution.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.4.11 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2016-04)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "high",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.4.11"
]
},
"publicationTime": "2016-12-19T15:29:00Z",
"disclosureTime": "2016-12-19T15:29:00Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-94"
]
},
"credit": [
"Dawid Golunski"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"cvssScore": 7.3,
"patches": [],
"upgradePath": []
},
{
"id": "SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268",
"url": "https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268",
"title": "Arbitrary URL Rewrite",
"type": "vuln",
"description": "## Overview\n[zendframework/zendframework](https://packagist.org/packages/zendframework/zendframework) provides functionality for consuming RSS and Atom feeds.\n\nAffected versions of this package are vulnerable to Arbitrary URL Rewrite. The request URI marshaling process contains logic that inspects HTTP request headers that are specific to a given server-side URL rewrite mechanism. \n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the URLs are subject to rewriting, allowing a malicious client or proxy to emulate the headers to request arbitrary content.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.5.0 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2018-01)\n",
"functions": [],
"from": [
"zendframework/[email protected]"
],
"package": "zendframework/zendframework",
"version": "2.1.0",
"severity": "medium",
"exploitMaturity": "no-known-exploit",
"language": "php",
"packageManager": "composer",
"semver": {
"vulnerable": [
"<2.5.0"
]
},
"publicationTime": "2018-08-15T08:34:54.643000Z",
"disclosureTime": "2018-08-02T16:29:46.707000Z",
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"identifiers": {
"CVE": [],
"CWE": [
"CWE-601"
]
},
"credit": [
"Drupal Security Team"
],
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"cvssScore": 5.3,
"patches": [],
"upgradePath": []
}
],
"licenses": []
},
"dependencyCount": 31,
"org": {
"name": "atokeneduser",
"id": "4a18d42f-0706-4ad0-b127-24078731fbed"
},
"licensesPolicy": null,
"packageManager": "composer"
}
