CVE-2014-2681

CVE-2014-2681 affects Zend Framework 1 (ZF1) < 1.12.4 and Zend Framework 2 < 2.1.6 / 2.2.x

CVE-2014-2685

The CVE-2014-2685 issue affects ZendOpenId (GenericConsumer in ZendOpenId) prior to 2.0.2 and Zend Framework 1 prior to 1.12.4. Root cause: the OpenID 2.0 verification logic accepts a signature that covers only at least one field, allowing an attacker to bypass authentication by leveraging an ass...

CVE-2014-2684

CVE-2014-2684 affects ZendOpenId (GenericConsumer in the Consumer component) up to version 2.0.2 and Zend Framework 1 up to 1.12.3/1.12.4, where there is a failure to verify that the openid_op_endpoint corresponds to the same Identity Provider used in the association handle. This allows an attack...

CVE-2014-2683

CVE-2014-2683 affects Zend Framework components (ZF1 < 1.12.4; ZF2 < 2.1.6,

CVE-2014-2682

CVE-2014-2682 affects Zend Framework 1 up to 1.12.4 and Zend Framework 2 up to 2.1.6 (and 2.2.x before 2.2.6), plus several Zend services, where PHP-FPM threading can share libxml_disable_entity_loader state, enabling XXE via an XML external entity and an entity reference. The issue continues an ...