URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

URL Rewrite vulnerability

More info at https://framework.zend.com/security/advisory/ZF2018-01...

Zend Framework: Multiple vulnerabilities

Background Zend Framework is a high quality and open source framework for developing Web Applications. Description Multiple vulnerabilities have been discovered in Zend Framework that have remain unaddressed. Please review the referenced CVE identifiers for details. Impact Remote attackers could...

Zend Framework 'Zend_Db_Select::order()' function SQL Injection Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A SQL injection vulnerability exists in versions of Zend Framework prior to 1.12.7, which stems from the program's...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

Sql injection

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The vulnerability CVE-2014-4914 affects Zend Framework’s Zend_Db_Select::order in versions prior to 1.12.7. The issue arises from improper handling of parentheses in the ORDER BY clause, enabling remote SQL injection via unspecified vectors. Affected product: Zend Framework (PHP framework); vulne...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

Shopware 5.3.3: PHP Object Instantiation to Blind XXE

Shopwareis a popular e-commerce software. It is based on PHP using technologies like Symfony 2, Doctrine and the Zend Framework. The code base of its open source community edition encompasses over 690,000 lines of code which we scanned for security vulnerabilities with our RIPS static code...

Code injection

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

CVE-2015-7503

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

CVE-2015-7503

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

CVE-2015-7503

CVE-2015-7503 affects Zend Framework and Zend Crypt RSA public-key encryption. Zend Framework 2.x before 2.4.9 and 2.5.x before 2.5.2 used OPENSSL_PKCS1_PADDING (PKCS#1 v1.5) in Zend\Crypt\PublicKey\Rsa::encrypt(), enabling a Bleichenbacher-style attack to recover the RSA private key. Exploitatio...

Zend Framework Session Authentication Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A security vulnerability exists in Zend/Session/SessionManager in version 2.2.x before ZF 2.2.9 and version 2.3.x...

Session fixation

Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators...

CVE-2015-1555

Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators...

CVE-2015-1555

Zend Framework 2.2.x prior to 2.2.9 and 2.3.x prior to 2.3.4 are vulnerable in Zend\Session/SessionManager to a session validation bypass that allows remote attackers to create valid sessions without session validators. Root cause: improper session validation logic in SessionManager. Impact: pote...

CVE-2015-1555

Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators...

PHPMailer 5.2.20 with Exim MTA - Remote Code Execution

PHPMailer 5.2.20 with Exim MTA - Remote Code Execution !/usr/bin/python Exploit Title: RCE for PHPMailer 5.2.20 with Exim MTA Date: 16/06/2017 Exploit Author: @phacktul Software Link: https://github.com/PHPMailer/PHPMailer Version: 5.2.20 Tested on: Debian x86/x64 CVE :...