Sylius

Records38All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

Sylius records in CISA KEV

No Sylius vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Sylius 19 records HIGH Syliusresourcebundle 3 records MEDIUM Grid 1 record LOW Paypal 1 record LOW Syliusgridbundle 1 record MEDIUM

Records

3 records in Syliusresourcebundle · all components

TI-2020-11918 CVE-2020-15146 · GHSA-h6m7-j4h3-9rf5

Remote Code Execution in SyliusResourceBundle

MEDIUM 45

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.02149 Published 2020-08-19 Fixed in 1.3.14, 1.4.7 +2 CWE-74

TI-2020-11916 CVE-2020-15143 · GHSA-p4pj-9g59-4ppv

Remote Code Execution in SyliusResourceBundle

MEDIUM 42

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01914 Published 2020-08-19 Fixed in 1.3.14, 1.4.7 +2 CWE-74

TI-2020-04276 CVE-2020-5220 · GHSA-8vp7-j5cj-vvm2

Ability to expose data in Sylius by using an unintended serialisation group

LOW 25

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00737 Published 2020-01-27 Fixed in 1.3.13, 1.4.6 +4 CWE-444

Open these records in search →

Critical	2
High	11
Medium	25
Low	0
No CVSS	0