Lucene search
Veracode Vulnerability DatabaseVERACODE:4836HistoryJul 31, 2017 - 12:02 a.m.
XML External Entity (XXE) Attacks
2017-07-3100:02:04
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
5
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Zendframework and several Zendservices are vulnerable to XML External Entity (XXE) attacks. The libxml_disable_entity_loader is not correctly shared between threads then PHP-FPM is used, allowing attackers to conduct XXE attacks. This is as a result of an incomplete fix for CVE-2012-5657.
Related
cve
cve
github
github
Several Zend Products Vulnerable to XXE and XEE attacks
2022-05-14 00:56:24
Zend Framework XXE Vulnerability
2022-05-17 05:10:46
Several Zend Products Vulnerable to XXE and XEE attacks
2022-05-14 00:56:24
osv
osv
Several Zend Products Vulnerable to XXE and XEE attacks
2022-05-14 00:56:24
zendframework - XML external entity inclusion
2013-01-08 00:00:00
Zend Framework XXE Vulnerability
2022-05-17 05:10:46
ubuntucve
ubuntucve
veracode
veracode
XML External Entity (XXE)
2017-06-02 06:02:10
openvas
openvas
Fedora Update for php-ZendFramework FEDORA-2013-0057
2013-01-21 00:00:00
Fedora Update for php-ZendFramework FEDORA-2013-0061
2013-01-21 00:00:00
Fedora Update for php-ZendFramework FEDORA-2013-0063
2013-01-21 00:00:00
nessus
nessus
Fedora 17 : php-ZendFramework-1.12.1-1.fc17 (2013-0057)
2013-01-21 00:00:00
Debian DSA-2602-1 : zendframework - XML external entity inclusion
2013-01-09 00:00:00
Mandriva Linux Security Advisory : php-ZendFramework (MDVSA-2013:115)
2013-04-20 00:00:00
amazon
amazon
Medium: php-ZendFramework
2013-02-04 15:19:00
Important: php-ZendFramework
2014-07-23 13:39:00
fedora
fedora
[SECURITY] Fedora 17 Update: php-ZendFramework-1.12.1-1.fc17
2013-01-20 03:09:02
[SECURITY] Fedora 18 Update: php-ZendFramework-1.12.1-1.fc18
2013-01-20 03:02:33
[SECURITY] Fedora 16 Update: php-ZendFramework-1.12.1-1.fc16
2013-01-20 03:08:19
securityvulns
securityvulns
[SECURITY] [DSA 2602-1] zendframework security update
2013-01-10 00:00:00
[SECURITY] [DSA 3265-1] zendframework security update
2015-06-08 00:00:00
[ MDVSA-2014:072 ] php-ZendFramework
2014-05-05 00:00:00
debian
debian
[SECURITY] [DSA 2602-1] zendframework security update
2013-01-08 18:23:03
[SECURITY] [DSA 3265-2] zendframework regression update
2015-05-24 11:55:24
[SECURITY] [DSA 3265-1] zendframework security update
2015-05-20 09:37:25
mageia
mageia
Updated php-ZendFramework packages fix multiple vulnerabilities
2014-04-03 04:43:46
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related for VERACODE:4836