GHSA-G52P-86J5-XR8Q ZendFramework Potential Cross-site Scripting in Development Environment Error View Script

The default error handling view script generated using ZendTool failed to escape request parameters when run in the "development" configuration environment, providing a potential XSS attack vector. ZendToolProjectContextZfViewScriptFile was patched such that the view script template now calls the...

ZendFramework Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

GHSA-XG9W-R469-M455 ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities

In Zend Framework 2, the Zend\Math\Rand component generates random bytes using the OpenSSL or Mcrypt extensions when available but will otherwise use PHP's mtrand function as a fallback. All outputs from mtrand are predictable for the same PHP process if an attacker can brute force the seed used ...

GHSA-JQ87-2WXP-8349 ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`

In Zend Framework 2, Zend\Mvc\Router\Http\Query is used primarily to allow appending query strings to URLs when assembled. However, due to the fact that it captures any query parameters into the RouteMatch, and the fact that RouteMatch parameters are merged with any parent routes, this can lead t...

PT-2024-40339

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue arises from the incorrect decoration of a TEXTAREA instead of a DIV by the Zend Dojo View Helper Editor. This has security implications as the rich text editor used is unable...

PT-2024-40351

Name of the Vulnerable Software and Affected Versions Zend Framework 2 affected versions not specified Description The issue arises from the use of ZendMvcRouterHttpQuery in Zend Framework 2, which can lead to overriding already captured routing parameters and bypassing constraints defined in...

PT-2024-40309

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to 1.7.6 Description The issue concerns the Zend Filter StripTags class, which is used for filtering HTML tags. It was discovered that attributes with whitespace or line breaks surrounding the assignment operator...

PT-2024-40208

Name of the Vulnerable Software and Affected Versions: Zend Framework 1 affected versions not specified Description: The issue is related to insufficient entropy in random number generation methods used in various parts of the Zend Framework 1. Specifically, the methods Zend Ldap...

PT-2024-40370

Name of the Vulnerable Software and Affected Versions Zend Framework versions prior to the fixed version Description The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select a...

PT-2024-40288

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to 1.11.4 Description: The default error handling view script generated using Zend Tool in the "development" configuration environment failed to escape request parameters, providing a potential XSS attack vector...

PT-2024-40320

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue concerns character encoding inconsistencies in several Zend Framework components, including Zend Form, Zend Filter, Zend Log, and Zend View. Specifically, the htmlspecialchar...

PT-2024-40515

Name of the Vulnerable Software and Affected Versions Zend Framework 2 affected versions not specified Description The issue concerns the ZendDb component in Zend Framework 2, which provides platform abstraction for SQL. Specifically, the quoteValue and quoteValueList methods in the platform...

PT-2024-40364

Name of the Vulnerable Software and Affected Versions Zend Framework 2 affected versions not specified Description The issue arises from the use of the escapeHtml view helper instead of the more appropriate escapeHtmlAttr to escape HTML attributes in various Zend Framework 2 view helpers. This ca...

PT-2024-40081

Name of the Vulnerable Software and Affected Versions: Zend Framework versions affected versions not specified Description: The issue concerns a potential XSS vulnerability in the Zend Service ReCaptcha MailHide component. It was possible for a malicious user to inject a specially crafted multiby...

PT-2024-40528

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue concerns the generation of random bytes in the ZendMathRand component, which uses PHP's mt rand function as a fallback when the OpenSSL or Mcrypt extensions are not...

PT-2024-40488

Name of the Vulnerable Software and Affected Versions Zend Framework affected versions not specified Description The issue arises from the Zend Json Encoder not properly handling the solidus character / during encoding, which leads to incompatibilities with the JSON specification. This...

PT-2024-40097

Name of the Vulnerable Software and Affected Versions: Zend Framework versions affected versions not specified Description: The issue concerns several components of the Zend Framework, including ZendDebug, ZendFeedPubSubHubbub, ZendLogFormatterXml, ZendTagCloudDecorator, ZendUri,...

PT-2024-40179

Name of the Vulnerable Software and Affected Versions: Zend Framework versions prior to the fixed version Description: The issue concerns the generation of CAPTCHA challenges. Specifically, the Zend Captcha Word v1 and ZendCaptchaWord v2 components use PHP's internal array rand function to select...

PT-2024-40200

Name of the Vulnerable Software and Affected Versions: Zend Framework 2 affected versions not specified Description: The issue arises from the use of the escapeHtml view helper instead of the more appropriate escapeHtmlAttr to escape HTML attributes in various Zend Framework 2 view helpers. This...

PT-2024-40465

Name of the Vulnerable Software and Affected Versions Zend Framework 1 affected versions not specified Description The issue concerns the PDO adapters in Zend Framework 1, which fail to filter null byte values in SQL statements. This oversight allows an attacker to inject arbitrary SQL code by...