porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

Security advisories for PHP and JavaScript packages.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

22 JAN 2018

HIGH7.5
yiisoft/yii2 composer

Remote attackers could obtain potentially sensitive information from exception messages printed by the error handler in non-debug mode.

fixed in 2.0.14

13 JAN 2018

HIGH8.8
yiisoft/yii2 composer

The switchIdentity() function in yii\web\User did not regenerate the CSRF token upon a change of identity

fixed in 2.0.14

21 SEP 2017

MODERATE5.9
laravel/framework composer

Timing attack vector for remember me token

fixed in 5.5.10

7 MAY 2017

MODERATE6.1
laravel/framework composer

Password reset phishing vulnerability

fixed in 5.4.22

13 NOV 2016

CRITICAL9.8
phpunit/phpunit composer

RCE vulnerability in phpunit

fixed in 4.8.28 · 5.6.3

15 JUL 2016

HIGH8.1
guzzlehttp/guzzle composer

HTTP Proxy header vulnerability

fixed in 4.2.4 · 5.3.1 · 6.2.1

7 DEC 2015

MODERATE6.5
dompdf/dompdf composer

Information Disclosure

fixed in 0.6.2

HIGH8.8
dompdf/dompdf composer

Remote Code Execution (complement of CVE-2014-2383)

fixed in 0.6.2

MODERATE6.5
dompdf/dompdf composer

Denial Of Service Vector

fixed in 0.6.2

12 AUG 2015

HIGH
twig/twig composer

Remote code execution in templates

fixed in 1.20.0

24 JUL 2015

HIGH7.8
aws/aws-sdk-php composer

Security Misconfiguration Vulnerability in the AWS SDK for PHP

fixed in 3.2.1

10 JUL 2015

CRITICAL
yiisoft/yii2 composer

class yii\web\ViewAction allowed to include arbitrary files that end with .php

fixed in 2.0.5

26 MAY 2015

MODERATE
symfony/http-kernel composer

CVE-2015-4050: ESI unauthorized access

fixed in 2.3.29 · 2.5.0 · 2.5.12 · 2.6.8

10 MAY 2015

MODERATE
yiisoft/yii2 composer

JSON Data encoded for use in HTML was not safe to use in IE6/IE7, possible XSS attacks

fixed in 2.0.4

2 APR 2015

CRITICAL
firebase/php-jwt composer

Critical vulnerabilities in JSON Web Token libraries

fixed in 2.0.0

1 APR 2015

MODERATE
symfony/http-kernel composer

Esi Code Injection

fixed in 2.3.27 · 2.5.11 · 2.6.6

MODERATE
symfony/http-foundation composer

Unsafe methods in the Request class

fixed in 2.3.27 · 2.5.11 · 2.6.6

29 DEC 2014

LOW
monolog/monolog composer

Header injection in NativeMailerHandler

fixed in 1.12.0

14 SEP 2014

HIGH
james-heinrich/getid3 composer

Potential XXE security issue

fixed in 1.9.9

3 SEP 2014

HIGH
symfony/http-kernel composer

Direct access of ESI URLs behind a trusted proxy

fixed in 2.3.19 · 2.4.9 · 2.5.4

MODERATE
symfony/http-foundation composer

Security issue when parsing the Authorization header

fixed in 2.3.19 · 2.4.9 · 2.5.4

HIGH
symfony/http-foundation composer

Denial of service with a malicious HTTP Host header

fixed in 2.3.19 · 2.4.9 · 2.5.4

20 MAY 2014

HIGH
laravel/framework composer

Risk of mass-assignment vulnerabilities

fixed in 4.0.99 · 4.1.29

15 APR 2014

HIGH
laravel/framework composer

Hijacked authentication cookies vulnerability

fixed in 4.0.99 · 4.1.26

10 MAR 2014

MODERATE
dompdf/dompdf composer

Arbitrary file read in dompdf

fixed in 0.6.1

HIGH
dompdf/dompdf composer

PHP remote file inclusion vulnerability in dompdf.php

fixed in 0.6.1

17 AUG 2013

MODERATE
symfony/http-foundation composer

Request::getHost() poisoning

fixed in 2.0.24 · 2.1.12 · 2.2.5 · 2.3.3

8 APR 2013

MODERATE
twig/twig composer

Vulnerability in the filesystem loader

fixed in 1.12.3

15 JAN 2013

HIGH
symfony/yaml composer

Ability to enable/disable object support in YAML parsing and dumping

fixed in 2.0.22 · 2.1.7

HIGH
symfony/yaml composer

Ability to enable/disable PHP parsing in Yaml::parse()

fixed in 2.0.22

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →