528 matches found
CVE-2014-2681
CVE-2014-2681 affects Zend Framework 1 (ZF1) < 1.12.4 and Zend Framework 2 < 2.1.6 / 2.2.x
CVE-2014-2684
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...
CVE-2014-2681
Zend Framework 1 ZF1 before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendServiceAudioScrobbler, ZendServiceNirvanix, ZendServiceSlideShare, ZendServiceTechnorati, and ZendServiceWindowsAzure before 2.0.2, ZendServiceAmazon before 2.0.3, and ZendServiceAp...
[SECURITY] Fedora 21 Update: php-ZendFramework-1.12.9-1.fc21
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...
MGASA-2014-0434 Updated php-ZendFramework packages fix security vulnerabilities
Due to a bug in PHP's LDAP extension, when ZendFramework's Zendldap class is used for logins, an attacker can login as any user by using a null byte to bypass the empty password check and perform an unauthenticated LDAP bind CVE-2014-8088. The sqlsrv PHP extension, which provides the ability to...
PT-2020-7742 · Zend · Zend Framework
Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.12.9 Zend Framework versions 2.2.x prior to 2.2.8 Zend Framework versions 2.3.x prior to 2.3.3 Description: The issue allows remote attackers to execute arbitrary SQL commands via a null byte when using the...
[SECURITY] Fedora 20 Update: php-ZendFramework2-2.3.3-2.fc20
Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...
UBUNTU-CVE-2014-8088
The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind...
[SECURITY] Fedora 20 Update: php-ZendFramework-1.12.9-1.fc20
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...
[SECURITY] Fedora 21 Update: php-ZendFramework2-2.3.3-1.fc21
Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...
Anonymous authentication in ldap_bind() function of PHP, using null byte
More info at https://framework.zend.com/security/advisory/ZF2014-05...
Anonymous authentication in ldap_bind() function of PHP, using null byte
More info at https://framework.zend.com/security/advisory/ZF2014-05...
CVE-2014-2685
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...
CVE-2014-2685
The CVE-2014-2685 issue affects ZendOpenId (GenericConsumer in ZendOpenId) prior to 2.0.2 and Zend Framework 1 prior to 1.12.4. Root cause: the OpenID 2.0 verification logic accepts a signature that covers only at least one field, allowing an attacker to bypass authentication by leveraging an ass...
CVE-2014-2685: Improper Authentication
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...
GLSA-201408-01 : Zend Framework: SQL injection
The remote host is affected by the vulnerability described in GLSA-201408-01 Zend Framework: SQL injection Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Impact : A remote attacker could use specially...
Zend Framework: SQL injection
Background Zend Framework is a high quality and open source framework for developing Web Applications. Description Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Impact A remote attacker could use special...
Important: php-ZendFramework
Issue Overview: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass...
[SECURITY] Fedora 20 Update: php-ZendFramework-1.12.7-1.fc20
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...
[SECURITY] Fedora 19 Update: php-ZendFramework-1.12.7-1.fc19
Extending the art & spirit of PHP, Zend Framework is based on simplicity, object-oriented best practices, corporate friendly licensing, and a rigorou sly tested agile code base. Zend Framework is focused on building more secure, reliable, and modern Web 2.0 applications & web services, and...