porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Composer and PHP security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

14 SEP 2014

HIGH
james-heinrich/getid3 composer

Potential XXE security issue

fixed in 1.9.9

3 SEP 2014

HIGH
symfony/http-kernel composer

Direct access of ESI URLs behind a trusted proxy

fixed in 2.3.19 · 2.4.9 · 2.5.4

MODERATE
symfony/http-foundation composer

Security issue when parsing the Authorization header

fixed in 2.3.19 · 2.4.9 · 2.5.4

HIGH
symfony/http-foundation composer

Denial of service with a malicious HTTP Host header

fixed in 2.3.19 · 2.4.9 · 2.5.4

20 MAY 2014

HIGH
laravel/framework composer

Risk of mass-assignment vulnerabilities

fixed in 4.0.99 · 4.1.29

15 APR 2014

HIGH
laravel/framework composer

Hijacked authentication cookies vulnerability

fixed in 4.0.99 · 4.1.26

10 MAR 2014

MODERATE
dompdf/dompdf composer

Arbitrary file read in dompdf

fixed in 0.6.1

HIGH
dompdf/dompdf composer

PHP remote file inclusion vulnerability in dompdf.php

fixed in 0.6.1

17 AUG 2013

MODERATE
symfony/http-foundation composer

Request::getHost() poisoning

fixed in 2.0.24 · 2.1.12 · 2.2.5 · 2.3.3

8 APR 2013

MODERATE
twig/twig composer

Vulnerability in the filesystem loader

fixed in 1.12.3

15 JAN 2013

HIGH
symfony/yaml composer

Ability to enable/disable object support in YAML parsing and dumping

fixed in 2.0.22 · 2.1.7

HIGH
symfony/yaml composer

Ability to enable/disable PHP parsing in Yaml::parse()

fixed in 2.0.22

29 NOV 2012

MODERATE
symfony/http-foundation composer

Request::getClientIp() when the trust proxy mode is enabled

fixed in 2.0.19 · 2.1.4

28 AUG 2012

HIGH
symfony/translation composer

Security fixes related to the way XML is handled

fixed in 2.0.17

HIGH
symfony/routing composer

Security fixes related to the way XML is handled

fixed in 2.0.17

19 MAR 2012

MODERATE
symfony/routing composer

Routes behind a firewall are accessible even when not logged in

fixed in 2.0.19

MODERATE
symfony/http-foundation composer

Routes behind a firewall are accessible even when not logged in

fixed in 2.0.19

24 FEB 2012

CRITICAL
symfony/serializer composer

XML decoding attack vector through external entities

fixed in 2.0.11

1 JUN 2010

MODERATE
ezyang/htmlpurifier composer

XSS vulnerability exploitable on Internet Explorer

fixed in 4.1.1

26 APR 2010

MODERATE
ezyang/htmlpurifier composer

Multiple XSS vulnerabilities exploitable on Internet Explorer

fixed in 4.1.0

← Newer

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →