CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2020-29312
https://notcve.org/view.php?id=CVE-2020-29312
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020. • http://zend.com https://cowtransfer.com/s/f9684f004d7149 https://github.com/zendframework/zendframework • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2012-4451
https://notcve.org/view.php?id=CVE-2012-4451
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Zend Framework versiones 2.0.x anteriores a la versión 2.0.1, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de una entrada no especificada en (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, o (8) View\Helper\Placeholder\Container\AbstractStandalone, relacionado con Escaper. • http://framework.zend.com/security/advisory/ZF2012-03 http://seclists.org/oss-sec/2012/q3/571 http://seclists.org/oss-sec/2012/q3/573 http://www.securityfocus.com/bid/55636 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10 https://bugs.gentoo.org/show_bug.cgi?id=436210 https://bugzilla.redhat.com/show_bug.cgi?id=860738 https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 0CVE-2014-4913
https://notcve.org/view.php?id=CVE-2014-4913
ZF2014-03 has a potential cross site scripting vector in multiple view helpers ZF2014-03, tiene un vector potencial de tipo cross site scripting en múltiples asistentes de vista. • http://www.openwall.com/lists/oss-security/2014/07/11/4 http://www.securityfocus.com/bid/66971 https://access.redhat.com/security/cve/cve-2014-4913 https://framework.zend.com/security/advisory/ZF2014-03 https://security-tracker.debian.org/tracker/CVE-2014-4913 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2016-6233
https://notcve.org/view.php?id=CVE-2016-6233
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression. Los métodos (1) order y (2) group en Zend_Db_Select en la Zend Framework en versiones anteriores a 1.12.19 podrían permitir a atacantes remotos llevar a cabo ataques de inyección SQL a través de vectores relacionados con el uso del patrón de caracteres [\w]* en una expresión regular. • http://www.securityfocus.com/bid/91802 https://framework.zend.com/security/advisory/ZF2016-02 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT https://security.gentoo.org/glsa/201804-10 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 2CVE-2016-4861
https://notcve.org/view.php?id=CVE-2016-4861
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation. Los métodos (1) order y (2) group en Zend_Db_Select en la Zend Framework en versiones anteriores a 1.12.20 podrían permitir a atacantes remotos llevar a cabo ataques de inyección SQL aprovechando el fallo para borrar comentarios de una sentencia SQL antes de la validación. • https://github.com/KosukeShimofuji/CVE-2016-4861 http://jvn.jp/en/jp/JVN18926672/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158 https://framework.zend.com/security/advisory/ZF2016-03 https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU https:/ • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •