PT-2024-40246

Name of the Vulnerable Software and Affected Versions: zend-diactoros affected versions not specified zend-http affected versions not specified zend-feed affected versions not specified Description: The issue concerns a potential URL rewrite exploit in the mentioned software components. It allows...

PT-2024-40109

Name of the Vulnerable Software and Affected Versions: Zend Session affected versions not specified Description: The issue arises when ZendSession session validators are set before the start of a session, causing them to not work as expected. This allows an attacker to bypass session validators...

PT-2024-40271

Name of the Vulnerable Software and Affected Versions: zend-diactoros affected versions not specified zend-http affected versions not specified zend-feed affected versions not specified Description: The issue concerns a potential URL rewrite exploit in the mentioned software components. It involv...

PT-2024-40370

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select a...

PT-2024-40084

Name of the Vulnerable Software and Affected Versions: Zend Filter StripTags affected versions not specified Description: The issue allows a malicious user to potentially include XSS exploits within HTML comments that would then be rendered in the final output, as Zend Filter StripTags contained ...

PT-2024-40179

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to the fixed version Description: The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select...

PT-2024-40488

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue arises from the Zend Json Encoder not properly handling the solidus character / during encoding, which leads to incompatibilities with the JSON specification. This...

PT-2024-40288

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.11.4 Description: The default error handling view script generated using Zend Tool in the "development" configuration environment failed to escape request parameters, providing a potential XSS attack vector...

PT-2024-40339

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue arises from the incorrect decoration of a TEXTAREA instead of a DIV by the Zend Dojo View Helper Editor. This has security implications as the rich text editor used is unable...

PT-2024-40309

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 1.7.6 Description The issue concerns the Zend Filter StripTags class, which is used for filtering HTML tags. It was discovered that attributes with whitespace or line breaks surrounding the assignment operator...

PT-2024-40528

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns the generation of random bytes in the ZendMathRand component, which uses PHP's mt rand function as a fallback when the OpenSSL or Mcrypt extensions are not...

PT-2024-40371

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue concerns improper parsing of HTTP headers for proxy information in certain Zend Framework components. Specifically, ZendSessionValidatorRemoteAddr and ZendViewHelperServerUrl...

PT-2024-40097

Name of the Vulnerable Software and Affected Versions: Zend Framework versions affected versions not specified Description: The issue concerns several components of the Zend Framework, including ZendDebug, ZendFeedPubSubHubbub, ZendLogFormatterXml, ZendTagCloudDecorator, ZendUri,...

PT-2024-40024

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue is related to the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to...

PT-2024-40081

Name of the Vulnerable Software and Affected Versions: Zend Framework versions affected versions not specified Description: The issue concerns a potential XSS vulnerability in the Zend Service ReCaptcha MailHide component. It was possible for a malicious user to inject a specially crafted multiby...

PT-2024-40465

Name of the Vulnerable Software and Affected Versions Zend Framework 1 affected versions not specified Description The issue concerns the PDO adapters in Zend Framework 1, which fail to filter null byte values in SQL statements. This oversight allows an attacker to inject arbitrary SQL code by...

PT-2024-40276

Name of the Vulnerable Software and Affected Versions: zend-diactoros affected versions not specified zend-http affected versions not specified zend-feed affected versions not specified Description: The issue concerns a potential URL rewrite exploit in the mentioned software components. It involv...

PT-2024-40074

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.11.13 and 1.12.0 Description: The issue concerns the insecure usage of PHP's DOM extension in Zend Feed Rss and Zend Feed Atom, allowing for potential XML eXternal Entity XXE vectors. This could be exploited...

PT-2024-40349

Name of the Vulnerable Software and Affected Versions zend-diactoros affected versions not specified zend-http affected versions not specified zend-feed affected versions not specified Description The issue concerns a potential URL rewrite exploit in the mentioned software components. It involves...

PT-2024-40320

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue concerns character encoding inconsistencies in several Zend Framework components, including Zend Form, Zend Filter, Zend Log, and Zend View. Specifically, the htmlspecialchar...