PatchTheCVEsymphony project vulnerabilities
Recent CVEs affecting symphony project products. 2 tracked.
symphony project has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-11-27. Highest priority: CVE-2017-16881 (score 41/100).
- CVE-2017-16956 MEDIUM 6.1 DOWNGRADE b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, a
- CVE-2017-16881 MEDIUM 6.1 DOWNGRADE b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted use
FAQ
How do I fix symphony project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is symphony project being exploited right now?
None of the tracked symphony project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which symphony project CVE should I patch first?
CVE-2017-16881 currently ranks highest (41/100): b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted use.