GHSA-VVM3-RV48-J3G5 Zendframework Potential XSS or HTML Injection vector in Zend_Json

ZendJsonEncoder was not taking into account the solidus character / during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string...

Zendframework Potential XSS or HTML Injection vector in Zend_Json

ZendJsonEncoder was not taking into account the solidus character / during encoding, leading to incompatibilities with the JSON specification, and opening the potential for XSS or HTML injection attacks when returning HTML within a JSON string...

Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

GHSA-2JX7-XG83-J2M7 Zendframework Denial of Service vector via XEE injection

ZendDom, ZendFeed, ZendSoap, and ZendXmlRpc are vulnerable to XML Entity Expansion XEE vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memo...

ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`

ZendFilterStripTags is a filtering class analogous to PHP's striptags function. In addition to stripping HTML tags and selectively keeping those provided in a whitelist, it also provides the ability to whitelist specific attributes to retain per whitelisted tag. The reporter discovered that...

GHSA-GWPM-PM6X-H7RJ ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`

ZendFilterStripTags is a filtering class analogous to PHP's striptags function. In addition to stripping HTML tags and selectively keeping those provided in a whitelist, it also provides the ability to whitelist specific attributes to retain per whitelisted tag. The reporter discovered that...

ZendFramework Potential Cross-site Scripting in Development Environment Error View Script

The default error handling view script generated using ZendTool failed to escape request parameters when run in the "development" configuration environment, providing a potential XSS attack vector. ZendToolProjectContextZfViewScriptFile was patched such that the view script template now calls the...

ZendFramework potential XML eXternal Entity injection vectors

ZendFeedRss and ZendFeedAtom were found to contain potential XML eXternal Entity XXE vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or...

GHSA-4J9X-G4X8-VCMF ZendFramework potential XML eXternal Entity injection vectors

ZendFeedRss and ZendFeedAtom were found to contain potential XML eXternal Entity XXE vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or...

ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings

A number of classes, primarily within the ZendForm, ZendFilter, ZendForm, ZendLog and ZendView components, contained character encoding inconsistencies whereby calls to the htmlspecialchars and htmlentities functions used undefined or hard coded charset parameters. In many of these cases develope...

GHSA-HG35-VQP3-FV39 ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings

A number of classes, primarily within the ZendForm, ZendFilter, ZendForm, ZendLog and ZendView components, contained character encoding inconsistencies whereby calls to the htmlspecialchars and htmlentities functions used undefined or hard coded charset parameters. In many of these cases develope...

ZendFramework potential SQL Injection Vector When Using PDO_MySql

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:...

GHSA-QF36-FX9F-232X ZendFramework potential SQL Injection Vector When Using PDO_MySql

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:...

GHSA-J543-VG33-G6VJ ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`

ZendDojoViewHelperEditor was incorrectly decorating a TEXTAREA instead of a DIV. The Dojo team has reported that this has security implications as the rich text editor they use is unable to escape content for a TEXTAREA...

ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`

ZendDojoViewHelperEditor was incorrectly decorating a TEXTAREA instead of a DIV. The Dojo team has reported that this has security implications as the rich text editor they use is unable to escape content for a TEXTAREA...

GHSA-F4FJ-Q6M4-CC52 ZendFramework vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

ZendFramework vulnerable to XXE/XEE attacks

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity XXE Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTY...

GHSA-HX3M-959F-V849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

GHSA-M7HR-J867-3F34 ZendFramework has potential Cross-site Scripting vector in multiple view helpers

Many Zend Framework 2 view helpers were using the escapeHtml view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting XSS attack...