CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2015-7503
https://notcve.org/view.php?id=CVE-2015-7503
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key. Zend Framework en versiones anteriores a la 2.4.9, zend-framework/zend-crypt en versiones 2.4.x anteriores a la 2.4.9 y 2.5.x anteriores a la 2.5.2 permite que atacantes remotos recuperen la clave privada RSA. • https://bugzilla.redhat.com/show_bug.cgi?id=1283137 https://framework.zend.com/security/advisory/ZF2015-10 • CWE-320: Key Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 13EXPL: 0CVE-2015-1555
https://notcve.org/view.php?id=CVE-2015-1555
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators. Zend/Session/SessionManager en Zend Framework 2.2.x en versiones anteriores a 2.2.9, 2.3.x en versiones anteriores a 2.3.4 permite que atacantes remotos creen sesiones válidas sin emplear validadores de sesión. • http://framework.zend.com/security/advisory/ZF2015-01 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2015-1786
https://notcve.org/view.php?id=CVE-2015-1786
Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. Vulnerabilidad de tipo Cross-site request forgery (CSRF) en Zend/Validator/Csrf en Zend Framework , versiones 2.3.x anteriores a la 2.3.6 a través de identificadores de tokenes mal construidos o nulos. • https://bugzilla.redhat.com/show_bug.cgi?id=1207781 https://framework.zend.com/changelog/2.3.6 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2016-6233
https://notcve.org/view.php?id=CVE-2016-6233
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression. Los métodos (1) order y (2) group en Zend_Db_Select en la Zend Framework en versiones anteriores a 1.12.19 podrían permitir a atacantes remotos llevar a cabo ataques de inyección SQL a través de vectores relacionados con el uso del patrón de caracteres [\w]* en una expresión regular. • http://www.securityfocus.com/bid/91802 https://framework.zend.com/security/advisory/ZF2016-02 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT https://security.gentoo.org/glsa/201804-10 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 2CVE-2016-4861
https://notcve.org/view.php?id=CVE-2016-4861
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation. Los métodos (1) order y (2) group en Zend_Db_Select en la Zend Framework en versiones anteriores a 1.12.20 podrían permitir a atacantes remotos llevar a cabo ataques de inyección SQL aprovechando el fallo para borrar comentarios de una sentencia SQL antes de la validación. • https://github.com/KosukeShimofuji/CVE-2016-4861 http://jvn.jp/en/jp/JVN18926672/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2016-000158 https://framework.zend.com/security/advisory/ZF2016-03 https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU https:/ • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •