CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2014-2682 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2682
09 Apr 2014 — Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 3%CPEs: 12EXPL: 0CVE-2014-2683 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2683
09 Apr 2014 — Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-17: DEPRECATED: Code •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-2684 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2684
09 Apr 2014 — The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values. La clase GenericCons... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 97EXPL: 0CVE-2014-2685 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2685
09 Apr 2014 — The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. La clase GenericConsumer en el componente Consumer en ZendOpenId anterior a 2.0.2 y la clase Zend_OpenId_Consumer en Zend Framework 1 anterior a 1.12.4 violan el protocolo O... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 15EXPL: 0CVE-2012-5657
https://notcve.org/view.php?id=CVE-2012-5657
02 May 2013 — The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. Las clases (1) Zend_Feed_Rss y (2) Zend_Feed_Atom en Zend_Feed en Zend Framework v1.11.x antes de v1.11.15 y v1.12.x antes de v1.12.1 permite a atacantes remotos leer ficheros, enviar ... • http://framework.zend.com/security/advisory/ZF2012-05 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 59EXPL: 0CVE-2012-6531
https://notcve.org/view.php?id=CVE-2012-6531
13 Feb 2013 — (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363. (1) Zend_Dom, (2) Zend_Feed, y (3) Zend_Soap en Zend Framework v1.x antes de v1.11.13 y v1.12.0 1.12.... • http://framework.zend.com/security/advisory/ZF2012-01 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 59EXPL: 0CVE-2012-6532
https://notcve.org/view.php?id=CVE-2012-6532
13 Feb 2013 — (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, y (4) Zend_XmlRpc en Zend Framework v1.x antes de v1.11.13 y antes v1.12.0 1.12.x de permitir a atacantes remotos provocar una denegac... • http://framework.zend.com/security/advisory/ZF2012-02 • CWE-399: Resource Management Errors •
CVSS: 9.1EPSS: 66%CPEs: 8EXPL: 1CVE-2012-3363 – Zend Framework < 2.0.0 beta4 < 1.12 RC1 < 1.11.11 - Local File Disclosure
https://notcve.org/view.php?id=CVE-2012-3363
13 Feb 2013 — Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack. Zend_XmlRpc 1.x de Zend Framework antes de v1.11.12 y antes v1.12.0 1.12.x,94 no controla correctamente las clases SimpleXMLElement, lo que permite a atacantes remotos leer archiv... • https://www.exploit-db.com/exploits/19408 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2011-3825
https://notcve.org/view.php?id=CVE-2011-3825
24 Sep 2011 — Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files. Zend Framework v1.11.3 en Zend Server CE v5.1.0 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con Validate.php y algun... • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 61EXPL: 2CVE-2009-4417
https://notcve.org/view.php?id=CVE-2009-4417
24 Dec 2009 — The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed." La función shutdown en la clase Zend_Log_Writer_Mail en Zend Framework (ZF) permite a atacantes dependientes del contexto enviar mensajes e-mail de su lección a varias direcciones a través de vectores relacionados con "events not yet mailed." • http://www.sektioneins.de/en/advisories/advisory-032009-piwik-cookie-unserialize-vulnerability • CWE-264: Permissions, Privileges, and Access Controls •