ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

GHSA-HX3M-959F-V849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`

ZendView is a component that utilizes PHP as a templating language. To utilize it, you specify "script paths" that contain view scripts, and then render view scripts by specifying subdirectories within those script paths; the output is then returned as a string value which may be cached or direct...

CVE-2015-1399

Magento CE 1.9.1.0 and EE 1.14.1.0 are affected by a PHP Remote Code Execution via the fetchView() in Mage_Core_Block_Template_Zend, caused by insufficient security checks when including a URL through setScriptPath. An authenticated administrator could execute arbitrary PHP on the server. No expl...

CVE-2015-3458: Undefined Security Weakness

The fetchView function in the MageCoreBlockTemplateZend class in Magento Community Edition CE 1.9.1.0 and Enterprise Edition EE 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stre...