PT-2024-40528

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns the generation of random bytes in the ZendMathRand component, which uses PHP's mt rand function as a fallback when the OpenSSL or Mcrypt extensions are not...

PT-2024-40515

Name of the Vulnerable Software and Affected Versions Zend Framework 2 affected versions not specified Description The issue concerns the ZendDb component in Zend Framework 2, which provides platform abstraction for SQL. Specifically, the quoteValue and quoteValueList methods in the platform...

PT-2024-40307

Name of the Vulnerable Software and Affected Versions Zend Framework 2 affected versions not specified Description The issue arises from the use of the escapeHtml view helper instead of the more suitable escapeHtmlAttr to escape HTML attributes in various Zend Framework 2 view helpers. This can...

PT-2024-40037

Name of the Vulnerable Software and Affected Versions Zend Framework 1 affected versions not specified Description The issue arises from the implementation of the ORDER BY SQL statement in Zend Db Select of Zend Framework 1, which contains a potential SQL injection vulnerability when the query...

PT-2024-40028

Name of the Vulnerable Software and Affected Versions Zend Dom, Zend Feed, Zend Soap, and Zend XmlRpc affected versions not specified Description The issue concerns XML Entity Expansion XEE vectors, which can lead to Denial of Service attacks. XEE attacks happen when the XML DOCTYPE declaration...

PT-2024-40465

Name of the Vulnerable Software and Affected Versions Zend Framework 1 affected versions not specified Description The issue concerns the PDO adapters in Zend Framework 1, which fail to filter null byte values in SQL statements. This oversight allows an attacker to inject arbitrary SQL code by...

PT-2024-40024

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue is related to the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to...

PT-2024-40125

Name of the Vulnerable Software and Affected Versions: Zend Db Select affected versions not specified Description: The implementation of ORDER BY and GROUP BY in Zend Db Select is prone to SQL injection when a combination of SQL expressions and comments are used. This issue can be exploited by...

PT-2024-40208

Name of the Vulnerable Software and Affected Versions: Zend Framework 1 affected versions not specified Description: The issue is related to insufficient entropy in random number generation methods used in various parts of the Zend Framework 1. Specifically, the methods Zend Ldap...

PT-2024-40002

Name of the Vulnerable Software and Affected Versions Zend XmlRpc affected versions not specified Description The issue concerns XML eXternal Entity XXE Injection attacks. It arises from the insecure use of the SimpleXMLElement class in the SimpleXML PHP extension for parsing XML data. An attacke...

PT-2024-40431

Name of the Vulnerable Software and Affected Versions zendframework/zend-developer-tools affected versions not specified Description The zendframework/zend-developer-tools package provides a web-based toolbar for application introspection. A change made to support PHP 7.3 could potentially preven...

PT-2024-40179

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to the fixed version Description: The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select...

PT-2024-40084

Name of the Vulnerable Software and Affected Versions: Zend Filter StripTags affected versions not specified Description: The issue allows a malicious user to potentially include XSS exploits within HTML comments that would then be rendered in the final output, as Zend Filter StripTags contained ...

PT-2024-40097

Name of the Vulnerable Software and Affected Versions: Zend Framework versions affected versions not specified Description: The issue concerns several components of the Zend Framework, including ZendDebug, ZendFeedPubSubHubbub, ZendLogFormatterXml, ZendTagCloudDecorator, ZendUri,...

PT-2024-40459 · Libxml2 +1 · Libxml2 +1

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns XML Entity Expansion XEE attacks, specifically Quadratic Blowup Attacks, which can lead to Denial Of Service attacks against a host's RAM. This is due to the lac...

PT-2024-40416 · Libxml2 +2 · Libxml2 +2

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns XML Entity Expansion XEE attacks, which can lead to Denial Of Service attacks against a host's RAM. This occurs because there is no current method of disabling...

PT-2024-40236 · Libxml2 +1 · Libxml2 +1

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns a vulnerability to XML Entity Expansion XEE attacks, specifically Quadratic Blowup Attacks, in software utilizing libxml2. This vulnerability allows for Denial O...

GHSA-26HQ-7286-MG8F Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the...

Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability

Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well. Note: while the vulnerability is scored as critical, few systems are affected. To be affected by the...

GHSA-9WV8-3H8H-X2WC doctrine/doctrine-module zero-valued authentication credentials vulnerability

it is possible under certain circumstances to obtain a valid Zend\Authentication identity even without knowing the user's credentials by using a numerically valued credential in DoctrineModule\Authentication\Adapter\ObjectRepository...