Lucene search

K

20 matches found

CVE
CVE
added 2019/11/26 10:15 p.m.228 views

CVE-2011-1939

SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.

9.8CVSS9.9AI score0.08543EPSS
CVE
CVE
added 2017/12/29 2:29 p.m.200 views

CVE-2014-4914

The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.

9.8CVSS7.9AI score0.03436EPSS
CVE
CVE
added 2013/02/13 5:55 p.m.143 views

CVE-2012-3363

Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML extern...

9.1CVSS9AI score0.64017EPSS
CVE
CVE
added 2020/02/17 10:15 p.m.121 views

CVE-2014-8089

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

9.8CVSS9.8AI score0.01115EPSS
CVE
CVE
added 2020/01/03 5:15 p.m.117 views

CVE-2012-4451

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) V...

6.1CVSS6AI score0.01779EPSS
CVE
CVE
added 2016/06/07 2:6 p.m.87 views

CVE-2015-5723

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local us...

7.8CVSS7.9AI score0.0011EPSS
CVE
CVE
added 2019/12/15 10:15 p.m.85 views

CVE-2014-4913

ZF2014-03 has a potential cross site scripting vector in multiple view helpers

6.1CVSS6.1AI score0.00565EPSS
CVE
CVE
added 2020/01/27 4:15 p.m.77 views

CVE-2015-3154

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

6.1CVSS6.4AI score0.00274EPSS
CVE
CVE
added 2017/02/17 2:59 a.m.76 views

CVE-2016-4861

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

9.8CVSS9.6AI score0.03977EPSS
CVE
CVE
added 2014/10/22 2:55 p.m.72 views

CVE-2014-8088

The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.

5CVSS9.4AI score0.00608EPSS
CVE
CVE
added 2016/12/30 7:59 p.m.72 views

CVE-2016-10034

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double q...

9.8CVSS9.4AI score0.82322EPSS
CVE
CVE
added 2014/11/16 12:59 a.m.69 views

CVE-2014-2684

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows re...

6.4CVSS9.3AI score0.00573EPSS
CVE
CVE
added 2014/11/16 12:59 a.m.68 views

CVE-2014-2683

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendSer...

5CVSS9.1AI score0.02975EPSS
CVE
CVE
added 2014/11/16 12:59 a.m.67 views

CVE-2014-2682

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendSer...

6.8CVSS9.4AI score0.01826EPSS
CVE
CVE
added 2014/09/04 5:55 p.m.65 views

CVE-2014-2685

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

7.5CVSS9.3AI score0.00837EPSS
CVE
CVE
added 2014/11/16 12:59 a.m.64 views

CVE-2014-2681

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendSer...

6.4CVSS9.3AI score0.03452EPSS
CVE
CVE
added 2017/02/17 2:59 a.m.61 views

CVE-2016-6233

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.

9.8CVSS9.4AI score0.01724EPSS
CVE
CVE
added 2023/04/04 3:15 p.m.58 views

CVE-2020-29312

An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.

9.8CVSS9.7AI score0.0187EPSS
CVE
CVE
added 2016/06/07 2:6 p.m.56 views

CVE-2015-7695

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

9.8CVSS9.6AI score0.01232EPSS
CVE
CVE
added 2019/10/25 3:15 p.m.48 views

CVE-2015-0270

Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.

9.8CVSS9.8AI score0.00394EPSS