13 matches found
ZF3_CVE-2021-3007
ZF3CVE-2021-3007 ZendFrameworkCVE-2021-3007 PoC...
Laminas Project laminas-http - Remote Code Execution
Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...
CVE-2021-3007-docker-poc
CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE This repository contains a fully reproducible Proof-of-Concept and Nuclei exploit template for CVE-2021-3007, a critical PHP deserialization vulnerability in Zend\Http\Response\Stream laminas-http Nuclei exploit template ├── docker-compose.yml...
cve-2021-3007-vulnerable
CVE-2021-3007 漏洞测试环境 用于验证安全扫描器中 CVE-2021-3007 检测的故意存在漏洞的测试环境。 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2021-3007 严重性| 严重（CVSS 9.8） 类型| 不安全的反序列化 → 远程代码执行 影响版本| Laminas HTTP 2.14.2, Zend Framework 3.0.0 CWE| CWE-502（不可信数据反序列化） 快速开始 root@kitploit: Clone repository git clone...
EUVD-2021-0845
Malware in sbrugna...
CVE-2021-3007
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...
GHSA-M496-X567-F98C Fixes a bug in Zend Framework's Stream HTTP Wrapper
Impact CVE-2021-3007: Backport of ZendHttpResponseStream, added certain type checking as a way to prevent exploitation. https://vulners.com/cve/CVE-2021-3007 This vulnerability is caused by the unsecured deserialization of an object. In versions higher than Zend Framework 3.0.0, the attacker abus...
CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
Deserialization of untrusted data
Magento-lts is a long-term support alternative to Magento Community Edition CE. In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework...
CVE-2021-21426
CVE-2021-21426 relates to Magento-lts (versions <= 19.4.12 and
RCE 'Bug' Found and Disputed in Popular PHP Scripting Framework
Versions of the popular developer tool Zend Framework and its successor Laminas Project can be abused by an attacker to execute remote code on PHP-based websites, if they are running web-based applications that are vulnerable to attack. However, those that maintain Zend Framework emphasize that t...
CVE-2021-3007
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...