CVE-2022-31109: Improper Neutralization of Input During Web Page Generation

laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol,...

GHSA-C8RP-CGF4-937W mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack

Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request...

mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack

Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request...

PT-2022-28234

Name of the Vulnerable Software and Affected Versions mezzio-swoole versions prior to 3.7.0 mezzio-swoole versions prior to 4.3.0 Description The issue affects mezzio-swoole applications using Diactoros for their PSR-7 implementation. If the application is not behind a proxy or can be accessed vi...

Cross-site Scripting (XSS)

laminas/laminas-diactoros is vulnerable to cross-site scripting. The vulnerability exists in the fromGlobals function in IncomingRequestFactory.php due to insufficient sanitization in the ServerRequest which allows an attacker to modify server request from x forwarded header via the request paylo...

GHSA-8274-H5JP-97VR Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack

Impact Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-...

Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack

Impact Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-...

PT-2022-20534 · Laminas · Laminas Diactoros

Name of the Vulnerable Software and Affected Versions: laminas-diactoros versions prior to 2.11.1 Description: The laminas-diactoros PHP package is vulnerable to potential host, protocol, and/or port modification of a LaminasDiactorosUri instance associated with the incoming server request, based...

Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack.

Impact Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded-...

Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack.

Description Impact Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from...

Laminas Project diactoros 环境问题漏洞

Laminas Project diactoros is a PSR HTTP message implementation of Laminas Project. An environment issue vulnerability exists in Laminas Project diactoros, which can be exploited by an attacker to add a new header to laminas-dictoros via Security/x Forwarded Header...

zend-diactoros Cross-site Scripting (XSS)

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...

URL Rewrite vulnerability in multiple zendframework components

zend-diactoros and, by extension, Expressive, zend-http and, by extension, Zend Framework MVC projects, and zend-feed specifically, its PubSubHubbub sub-component each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request...

PT-2022-28239

Name of the Vulnerable Software and Affected Versions zend-diactoros affected versions not specified zend-http affected versions not specified zend-feed affected versions not specified Description The issue concerns a potential URL rewrite exploit in the mentioned software components. It involves...

Fedora 28 : php-zendframework-zend-diactoros (2018-4a606489ae)

1.8.4 - 2018-08-01 Added - Nothing. Changed - This release modifies how ServerRequestFactory marshals the request URI. In prior releases, we would attempt to inspect the X-Rewrite-Url and X-Original-Url headers, using their values, if present. These headers are issued by the ISAPIRewrite module f...

Fedora Update for php-zendframework-zend-diactoros FEDORA-2018-4a606489ae

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-zendframework-zend-diactoros FEDORA-2018-dbb0d41078

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-005) - Linux

Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Drupal Core - 3rd-party libraries -SA-CORE-2018-005

The Drupal project uses the Symfony library. The Symfony library has released a security update that impacts Drupal. Refer to the Symfony security advisory for the issue. The same vulnerability also exists in the Zend Feed and Diactoros libraries included in Drupal core; however, Drupal core does...

Cross-Site Scripting (XSS)

zend-diactoros is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript through the URI of a generated form...