CVSS: 7.5EPSS: 0%CPEs: 59EXPL: 0CVE-2012-6531
https://notcve.org/view.php?id=CVE-2012-6531
13 Feb 2013 — (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363. (1) Zend_Dom, (2) Zend_Feed, y (3) Zend_Soap en Zend Framework v1.x antes de v1.11.13 y v1.12.0 1.12.... • http://framework.zend.com/security/advisory/ZF2012-01 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 8%CPEs: 8EXPL: 1CVE-2012-3363 – Zend Framework < 2.0.0 beta4 < 1.12 RC1 < 1.11.11 - Local File Disclosure
https://notcve.org/view.php?id=CVE-2012-3363
13 Feb 2013 — Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack. Zend_XmlRpc 1.x de Zend Framework antes de v1.11.12 y antes v1.12.0 1.12.x,94 no controla correctamente las clases SimpleXMLElement, lo que permite a atacantes remotos leer archiv... • https://www.exploit-db.com/exploits/19408 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 59EXPL: 0CVE-2012-6532
https://notcve.org/view.php?id=CVE-2012-6532
13 Feb 2013 — (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, y (4) Zend_XmlRpc en Zend Framework v1.x antes de v1.11.13 y antes v1.12.0 1.12.x de permitir a atacantes remotos provocar una denegac... • http://framework.zend.com/security/advisory/ZF2012-02 • CWE-399: Resource Management Errors •