Filtered by vendor Yiiframework
Subscribe
Search
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-50714 | 1 Yiiframework | 1 Yii2-authclient | 2024-01-08 | N/A | 8.8 HIGH |
| yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available. | |||||
| CVE-2021-3689 | 1 Yiiframework | 1 Yii | 2022-04-25 | 5.0 MEDIUM | 7.5 HIGH |
| yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator | |||||
| CVE-2018-6010 | 1 Yiiframework | 1 Yiiframework | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php. | |||||
| CVE-2018-8074 | 1 Yiiframework | 1 Yii | 2018-04-20 | 6.8 MEDIUM | 8.1 HIGH |
| Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension. | |||||
| CVE-2018-6009 | 1 Yiiframework | 1 Yiiframework | 2018-02-09 | 6.8 MEDIUM | 8.8 HIGH |
| In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity. | |||||