1148 matches found
PT-2014-4870
Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions prior to 1.12.4 ZendOpenId versions prior to 2.0.2 Description The issue allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenI...
PT-2014-4869
Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and...
PT-2014-4868
Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and...
PT-2014-4871
Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions prior to 1.12.4 ZendOpenId versions prior to 2.0.2 Description The issue concerns the GenericConsumer class in the Consumer component and the Zend OpenId Consumer class, which do not fully adhere to the OpenID 2.0...
PT-2014-4867
Name of the Vulnerable Software and Affected Versions Zend Framework 1 versions 1.12.3 and earlier Zend Framework 2 versions 2.1.5 and earlier, 2.2.x versions 2.2.5 and earlier ZendOpenId version 2.0.1 and earlier ZendRest version 2.0.1 and earlier ZendService AudioScrobbler version 2.0.1 and...
Zend Framework XML外部实体和安全绕过漏洞
Bugtraq ID:66358 Zend Framework是一款开放源代码的PHP5开发框架实现。 Zend Framework存在多个安全漏洞： 1，处理XML实体时存在错误，允许攻击者通过特制的包含外部实体引用的XML文档来获取本地文件内容或消耗服务器资源。 2，ZendOpenId和ZendOpenId consumer的登录机制存在错误，允许攻击者利用漏洞无需任意验证凭据伪造其他用户/身份。 0 Zend Framework 1.x Zend Framework 1.12.4已经修复该漏洞，建议用户下载更新： http://framework.zend.com...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential XXE/XEE attacks using PHP functions: simplexml_load_*, DOMDocument::loadXML, and xml_parse
More info at https://framework.zend.com/security/advisory/ZF2014-01...
Potential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer
More info at https://framework.zend.com/security/advisory/ZF2014-02...
Jackie CMS 1.7 commercial version SQL injection vulnerability analysis-vulnerability warning-the black bar safety net
Jackie CMS 1.7 commercial version with the Zend encryption, batch after decryption, found the programmer with several functions, making this system substantially no injection vulnerabilities. In the judgment of ip, the programmers will. The filter then determines whether it is Digital, it is wort...
Jackie CMS 1.7 commercial version injection vulnerability-vulnerability warning-the black bar safety net
Jackie CMS 1.7 commercial version with the Zend encryption, batch after decryption, found the programmer with several functions, making this system substantially no injection vulnerabilities. In the judgment of ip, the programmers will. The filter then determines whether it is Digital, it is wort...
Zend-Framework - Full Info Disclosure Vulnerability
Exploit for php platform in category web applications Exploit Title : Zend-Framework Full Info Disclosure Google Dork : inurl:/application/configs/application.ini Date : 26/11/2013 Exploit Author : Ariel Orellana Vendor Homepage : http://framework.zend.com/ Category : Web applications Tested on :...
Zend-Framework - Full Information Disclosure
Zend-Framework - Full Information Disclosure Exploit Title : Zend-Framework Full Info Disclosure Google Dork : inurl:/application/configs/application.ini Date : 26/11/2013 Exploit Author : Ariel Orellana Vendor Homepage : http://framework.zend.com/ Category : Web applications Tested on : GNU/Linu...
Zend-Framework - Full Information Disclosure
Exploit Title : Zend-Framework Full Info Disclosure Google Dork : inurl:/application/configs/application.ini Date : 26/11/2013 Exploit Author : Ariel Orellana Vendor Homepage : http://framework.zend.com/ Category : Web applications Tested on : GNU/Linux CommentGreetz : Daniel Godoy PoC : The...
Potential Remote Address Spoofing Vector in Zend\Http\PhpEnvironment\RemoteAddress
More info at https://framework.zend.com/security/advisory/ZF2013-04...
Amazon Linux AMI : php-ZendFramework (ALAS-2013-153)
The 1 ZendFeedRss and 2 ZendFeedAtom classes in ZendFeed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service CPU and memory consumption via an XML External...
CVE-2013-3735
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...
CVE-2013-3735
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...
Code injection
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...
CVE-2013-3735
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service memory consumption and application crash via a crafted function definition, as demonstrated by an atta...