Vulnerabilities

TI-2024-15203 CVE-2024-23049 · GHSA-frpg-52qc-h9c8

An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

HIGH 76

An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01169 Published 2024-02-05 No fix listed CWE-77

TI-2019-13035 CVE-2019-17488 · GHSA-9xjh-xm9r-h4hj

b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.

LOW 29

b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00818 Published 2019-10-10 No fix listed CWE-79

TI-2018-11634 CVE-2018-16249 · GHSA-wqgc-324m-v77q

In Symphony before 3.3.0, there is XSS in the Title under Post.

LOW 23

In Symphony before 3.3.0, there is XSS in the Title under Post.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00524 Published 2019-06-20 No fix listed CWE-79

TI-2019-06606 CVE-2019-9142 · GHSA-xgjc-49cw-529m

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7.

LOW 29

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00802 Published 2019-02-25 Fixed in 3.4.7 CWE-79

TI-2018-07378 CVE-2018-10469 · GHSA-w29q-jwvm-687v

b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary…

MEDIUM 46

b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02084 Published 2018-04-27 No fix listed CWE-434

TI-2017-12373 CVE-2017-16821 · GHSA-2jpm-mx7w-4vr7

b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin…

LOW 25

b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/us…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00479 Published 2017-11-15 No fix listed CWE-79

Vulnerabilities

Filters

An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.

In Symphony before 3.3.0, there is XSS in the Title under Post.

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7.

b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary…

b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin…