CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2015-7695
https://notcve.org/view.php?id=CVE-2015-7695
07 Jun 2016 — The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query. Los adaptadores PDO en Zend Framework en versiones anteriores a 1.12.16 no filtran bytes null en sentencias SQL, lo que permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una consulta manipulada. • http://framework.zend.com/security/advisory/ZF2015-08 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 25EXPL: 0CVE-2015-5723 – Debian Security Advisory 3369-1
https://notcve.org/view.php?id=CVE-2015-5723
07 Oct 2015 — Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code. Doctrine Annotations en versiones anteriores a 1.2.7, Cach... • http://framework.zend.com/security/advisory/ZF2015-07 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 35%CPEs: 154EXPL: 7CVE-2015-5161 – Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection
https://notcve.org/view.php?id=CVE-2015-5161
13 Aug 2015 — The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters. Vulnerabilidad en el Zend_Xml_Security::scan en ZendXml en versiones anteriores a 1.0.1 y Zend Framework en versiones anteriores a 1.12.14, 2.x en versiones anteriores ... • https://packetstorm.news/files/id/133068 •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2015-3154 – Debian Security Advisory 3265-1
https://notcve.org/view.php?id=CVE-2015-3154
20 May 2015 — CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email. Una vulnerabilidad de inyección de tipo CRLF en Zend\Mail (Zend_Mail) en Zend Framework versiones anteriores a 1.12.12, versiones 2.x anteriores a 2.3.8 y versiones 2.4.x anteriores a 2.4.1, permite a atacantes remotos inyectar encabeza... • http://framework.zend.com/security/advisory/ZF2015-04 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 7%CPEs: 8EXPL: 1CVE-2014-8089 – Debian Security Advisory 3265-1
https://notcve.org/view.php?id=CVE-2014-8089
30 Mar 2015 — SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. Una vulnerabilidad de inyección SQL en Zend Framework versiones anteriores a 1.12.9, versiones 2.2.x anteriores a 2.2.8 y versiones 2.3.x anteriores a 2.3.3, cuando se usa la extensión PHP sqlsrv, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio de un byte null. XML eXter... • http://framework.zend.com/security/advisory/ZF2014-06 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 21EXPL: 0CVE-2014-8088 – Mandriva Linux Security Advisory 2014-216
https://notcve.org/view.php?id=CVE-2014-8088
22 Oct 2014 — The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. (1) La clase Zend_Ldap en Zend anterior a 1.12.9 y (2) el componente Zend\Ldap en Zend 2.x anterior a 2.2.8 y 2.3.x anterior a 2.3.3 permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un byte nulo, lo que provoca un... • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141070.html • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 17%CPEs: 4EXPL: 2CVE-2011-1939 – Zend Framework 1.11.4 - 'PDO_MySql' Security Bypass
https://notcve.org/view.php?id=CVE-2011-1939
04 Aug 2014 — SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6. Una vulnerabilidad de inyección SQL en Zend Framework versiones 1.10.x anteriores a la versión 1.10.9 y versiones 1.11.x anteriores a la versión 1.11.6, cuando son utilizadas codificaciones no compatibles con ASCII junto con PDO_MySql en PHP versiones anteriores a la versión 5.3.6. A vulnerability in Zend Framework could allow a r... • https://www.exploit-db.com/exploits/35784 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 3%CPEs: 3EXPL: 0CVE-2014-4914 – Mandriva Linux Security Advisory 2014-145
https://notcve.org/view.php?id=CVE-2014-4914
01 Aug 2014 — The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. La función Zend_Db_Select::order en Zend Framework, en versiones anteriores a la 1.12.7, no gestiona correctamente los paréntesis. Esto permite que atacantes remotos lleven a cabo ataques de inyección SQL mediante vectores sin especificar. XML eXternal Entity flaws were discovered in the Zend Framework. An attacker co... • http://framework.zend.com/security/advisory/ZF2014-04 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 3%CPEs: 12EXPL: 0CVE-2014-2681 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2681
09 Apr 2014 — Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) at... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2014-2682 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2682
09 Apr 2014 — Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-19: Data Processing Errors •