UBUNTU-CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

CVE-2015-2937

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service "quadratic blowup" and memory consumption via an XML file containing an entity declaration with long replacement text and many references to th...

CVE-2015-2937

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service "quadratic blowup" and memory consumption via an XML file containing an entity declaration with long replacement text and many references to th...

Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: In MediaWiki before 1.23.9, one could circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in the SVG CVE-2015-2931. In MediaWiki before 1.23.9, the SVG filter to prevent injecting JavaScrip...

[SECURITY] Fedora 21 Update: php-ZendFramework2-2.3.7-1.fc21

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

[SECURITY] Fedora 20 Update: php-ZendFramework2-2.3.7-1.fc20

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

[SECURITY] Fedora 22 Update: php-ZendFramework2-2.3.7-1.fc22

Zend Framework 2 is an open source framework for developing web applications and services using PHP 5.3+. Zend Framework 2 uses 100% object-oriented code and utilizes most of the new features of PHP 5.3, namely namespaces, late static binding, lambda functions and closures. Zend Framework 2 evolv...

Potential SQL injection in PostgreSQL Zend\Db adapter

More info at https://framework.zend.com/security/advisory/ZF2015-02...

Potential SQL injection in PostgreSQL Zend\Db adapter

More info at https://framework.zend.com/security/advisory/ZF2015-02...

Zend PHP Advanced Local File Inclusion (CVE-2010-2094)

This vulnerability class creates a new method for attackers for exploiting file inclusion vulnerabilities. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the compromised machine...

Zend Framework Session Validators Security Bypass Vulnerability

Zend Framework ZF is an open source PHP5 development framework for developing web programs and services. A session authenticator security restriction bypass vulnerability exists in the implementation of Zend Framework, which can be exploited by an attacker to bypass certain security restrictions...

Session validation vulnerability

More info at https://framework.zend.com/security/advisory/ZF2015-01...

Session validation vulnerability

More info at https://framework.zend.com/security/advisory/ZF2015-01...

CVE-2014-9425

Double free vulnerability in the zendtshashgracefuldestroy function in zendtshash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2014-9425

Double free vulnerability in the zendtshashgracefuldestroy function in zendtshash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2014-9425

Double free vulnerability in the zendtshashgracefuldestroy function in zendtshash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2014-9425

CVE-2014-9425 is a double-free vulnerability in the Zend Engine’s zend_ts_hash_graceful_destroy, affecting PHP up to 5.5.20 and 5.6.x up to 5.6.4. The issue can enable remote denial of service or potentially other impacts via unknown vectors. Connected advisories (e.g., MiracleLinux AXSA:2015-184...

Medium: php-ZendFramework

Issue Overview: The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. CVE-2014-8088 The 1.12.9, 2.2.8,...

MantisBT XmlImportExport Plugin PHP Code Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability', 'Description' = %q This module exploits a post-auth vulnerability...

CVE-2014-2683

Zend Framework 1 ZF1 before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendServiceAudioScrobbler, ZendServiceNirvanix, ZendServiceSlideShare, ZendServiceTechnorati, and ZendServiceWindowsAzure before 2.0.2, ZendServiceAmazon before 2.0.3, and ZendServiceAp...