GHSA-HX3M-959F-V849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

PT-2024-40335

Name of the Vulnerable Software and Affected Versions Zend View versions up to and including 1.7.4 Description The issue concerns a Local File Inclusion problem. If untrusted input is used to specify the script path and/or view script, a malicious attacker could potentially specify a system...

CVE-2015-1399

A PHP remote file inclusion vulnerability exists in the fetchView function within the Mage_Core_Block_Template_Zend class of Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 . The root cause is a lack of security mechanisms, allowing an authenticated administrator to ex...

CVE-2015-3458: Undefined Security Weakness

The fetchView function in the MageCoreBlockTemplateZend class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stre...