CVE-2018-10230

CVE-2018-10230 affects Zend Server prior to 9.1.3 where Zend Debugger is vulnerable to Cross-Site Scripting. Exploitation path identified in Nuclei templates uses the debug_host parameter to inject arbitrary HTML/JavaScript into the server response, enabling a user’s browser to execute scripts. I...

Zend Framework: Multiple vulnerabilities

Background Zend Framework is a high quality and open source framework for developing Web Applications. Description Multiple vulnerabilities have been discovered in Zend Framework that have remain unaddressed. Please review the referenced CVE identifiers for details. Impact Remote attackers could...

Ensure Application Security with Zend Server and RIPS

Zend Server is the ultimate and most secure software platform for deploying, monitoring, debugging, maintaining, and optimizing enterprise PHP applications. It also helps to keep the technology stack up-to-date and to avoid security risks that stem from outdated components. However, most of the...

Kaltura Remote PHP Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Kaltura Remote PHP Code Execution over Cookie', 'Description' = %q This module exploits an Object Injection vulnerability in Kaltura. By exploiti...

Zend Framework 'Zend_Db_Select::order()' function SQL Injection Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. A SQL injection vulnerability exists in versions of Zend Framework prior to 1.12.7, which stems from the program's...

Sql injection

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The ZendDbSelect::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors...

CVE-2014-4914

The vulnerability CVE-2014-4914 affects Zend Framework’s Zend_Db_Select::order in versions prior to 1.12.7. The issue arises from improper handling of parentheses in the ORDER BY clause, enabling remote SQL injection via unspecified vectors. Affected product: Zend Framework (PHP framework); vulne...

Shopware 5.3.3: PHP Object Instantiation to Blind XXE

Shopwareis a popular e-commerce software. It is based on PHP using technologies like Symfony 2, Doctrine and the Zend Framework. The code base of its open source community edition encompasses over 690,000 lines of code which we scanned for security vulnerabilities with our RIPS static code...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

Information Disclosure

Zendframework and zend-crypt are vulnerable to information disclosure attacks. The library uses the default php $padding which is vulnerable to Bleichenbacher's chosen-ciphertext attack that can be used to decrypt arbitrary ciphertext...

Code injection

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

CVE-2015-7503

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

CVE-2015-7503

CVE-2015-7503 affects Zend Framework and Zend Crypt RSA public-key encryption. Zend Framework 2.x before 2.4.9 and 2.5.x before 2.5.2 used OPENSSL_PKCS1_PADDING (PKCS#1 v1.5) in Zend\Crypt\PublicKey\Rsa::encrypt(), enabling a Bleichenbacher-style attack to recover the RSA private key. Exploitatio...

CVE-2015-7503

Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...

Kaltura Remote PHP Code Execution over Cookie

This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura makes use of a hardcoded cookie secret which allows to sign arbitrary cookie data. After passing...

Cross-Site Scripting (XSS)

zend-diactoros is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript through the URI of a generated form...

Cross site scripting

Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting XSS or open redirect attacks...