991 matches found
ZF3_CVE-2021-3007
ZF3CVE-2021-3007 ZendFrameworkCVE-2021-3007 PoC...
Zend Server <9.13 - Cross-Site Scripting
Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. id: CVE-2018-10230 info: name: Zend Server 9.13 - Cross-Site Scripting author: marcosiaf severity: medium description: | Zend Server before version 9.13 is vulnerable to cross-site scripting via the...
Laminas Project laminas-http - Remote Code Execution
Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...
CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS8.4:CLSA-2026:1772811390)
The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1772811390 advisory. - The izvalptrdtor function in Zend/zendvariables.h in PHP 7.1.5 allows attackers to cause a denial of service memory consumption and...
zend-crypt
zend-crypt リポジトリは2019-12-31に放棄されました このリポジトリは laminas/laminas-crypt に移動しました。 Zend\Crypt は、いくつかの暗号化ツールのサポートを提供します。 利用可能な機能の一部は次のとおりです。 対称暗号を使用したencrypt-then-authenticate（認証ステップは HMACによって提供されます）; 対称鍵および公開鍵アルゴリズムを使用した暗号化/復号化（例: RSAアルゴリズム）; ハイブリッドモード（OpenPGPライク）を使用した暗号化/復号化; 公開鍵アルゴリズムを使用したデジタル署名の生成（例:...
CLSA-2026-1789384773 TuxCare security update for zendframework/zend-view (1 CVE)
TuxCare rebuilt zendframework/zend-view to address 1 CVE. Fixed in 2.1.6-p1+tuxcare...
CLSA-2026-1789376005 TuxCare security update for zendframework/zend-session (1 CVE)
TuxCare rebuilt zendframework/zend-session to address 1 CVE. Fixed in 2.1.6-p1+tuxcare...
CVE-2010-4176
creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:46+00:00| seen| https://t.me/hackingAttack/49649 2026-09-01 20:01:51+00:00| seen| https://t.me/hackingAttack/45702 2026-09-02 01:01:58+00:00| seen| https://t.me/hackingAttack/49649 2026-09-02 01:02:04+00:00| seen|...
CLSA-2026-1771548781 TuxCare security update for zendframework/zendframework1 (7 CVEs)
TuxCare rebuilt zendframework/zendframework1 to address 7 CVEs. Fixed in 1.12.10-p1+tuxcare...
CLSA-2026-1779151616 TuxCare security update for zendframework/zend-http (1 CVE)
TuxCare rebuilt zendframework/zend-http to address 1 CVE. Fixed in 2.5.6-p1+tuxcare...
php: heap-based buffer overflow in array_merge()
A flaw was found in PHP. A heap-based buffer overflow occurs in the arraymerge function when the total element count of packed arrays exceeds the 32-bit limit or the internal HTMAXSIZE due to an integer overflow in the precomputation of element counts using the zendhashnumelements function, causi...
Magento's X-Original-Url header can expose admin url
Impact The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. Patches The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process. Workarounds Unset the X-Original-Url header i...
GHSA-JG68-VHV3-9R8F Magento's X-Original-Url header can expose admin url
Impact The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. Patches The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process. Workarounds Unset the X-Original-Url header i...
PT-2026-6440
Impact The admin url can be discovered without prior knowledge of its location by exploiting the X-Original-Url header on some configurations. Patches The bug comes from the Zend library. Workarounds Unset the X-Original-Url header in the web server configuration. Resources...
CLSA-2026-1769445556 php: Fix of CVE-2025-14178
CVE-2025-14178: fix heap buffer overflow in arraymerge due to integer overflow in zendhashnumelements precomputation...
CLSA-2026-1768300005 php: Fix of CVE-2025-14178
CVE-2025-14178: fix integer overflow in the precomputation of element counts using zendhashnumelements...
CVE-2009-4417
The shutdown function in the ZendLogWriterMail class in Zend Framework ZF allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."...
CVE-2015-0270
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter...
