CVE-2022-23598 Reflected XSS vulnerability when rendering error messages in laminas-form

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the formElementErrors view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value wa...

CVE-2022-23598 Reflected XSS vulnerability when rendering error messages in laminas-form

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the formElementErrors view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value wa...

CVE-2022-23598 Reflected XSS vulnerability when rendering error messages in laminas-form

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the formElementErrors view helper shipped with laminas-form, many messages will contain the submitted value. However, in laminas-form prior to version 3.1.1, the value wa...

CVE-2022-23598

laminas-form is vulnerable to reflected XSS when rendering validation error messages via formElementErrors() in versions prior to 3.1.1, because submitted values were not escaped in HTML contexts. The CVE description notes that 3.1.1 and newer include a patch. A workaround exists (code to escape ...

Reflected XSS vectors in laminas/laminas-form

The package laminas/laminas-form contains a laminas/laminas-view view helper for emitting form element, fieldset, and/or form validation errors, formElementError. Validation messages can contain the original input, potentially resulting in a Reflected XSS vulnerability. Affected versions...

laminas-form 跨站脚本漏洞

laminas-form is an open source library , mainly used as a bridge between the domain model and the view layer . It consists of a thin object layer representing form elements, an InputFilter, and a handful of methods for binding data to the form and attaching objects. A security vulnerability exist...

GHSA-XX8F-QF9F-5FGW Remote code execution in zendframework and laminas-http

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

Remote code execution in zendframework and laminas-http

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

FreakOut! Ongoing Botnet Attack Exploiting Recent Linux Vulnerabilities

An ongoing malware campaign has been found exploiting recently disclosed vulnerabilities in network-attached storage NAS devices running on Linux systems to co-opt the machines into an IRC botnet for launching distributed denial-of-service DDoS attacks and mining Monero cryptocurrency. The attack...

VulnCheck KEV: CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

RCE 'Bug' Found and Disputed in Popular PHP Scripting Framework

Versions of the popular developer tool Zend Framework and its successor Laminas Project can be abused by an attacker to execute remote code on PHP-based websites, if they are running web-based applications that are vulnerable to attack. However, those that maintain Zend Framework emphasize that t...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

Deserialization of untrusted data

DISPUTED Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas-http

PT-2021-18593 · Zend +1 · Zend Framework +1

Name of the Vulnerable Software and Affected Versions: Laminas Project laminas-http versions prior to 2.14.2 Zend Framework version 3.0.0 Description: The issue is related to a deserialization vulnerability that can lead to remote code execution if the content is controllable. This is due to the...

Laminas Project laminas-http and Zend Framework Code Issues Vulnerabilities

ZEND Zend Framework is an open source PHP development framework from ZEND Corporation, which is mainly used for developing web programs and services.Laminas Project laminas-http is an HTTP message and header abstraction and HTTP client implementation of the Laminas Project. A code issue...

XSS vectors in laminas-api-tools/api-tools

The package laminas-api-tools/api-tools bundles a number of javascript assets for purposes of providing an adminstration GUI and/or landing page. Some of these assets had reported XSS cross-site scripting vulnerabilities: Affected versions laminas-api-tools/api-tools versions prior to 1.4.1. Acti...