CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2020-29312
https://notcve.org/view.php?id=CVE-2020-29312
04 Apr 2023 — An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020. • http://zend.com • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2014-4913
https://notcve.org/view.php?id=CVE-2014-4913
15 Dec 2019 — ZF2014-03 has a potential cross site scripting vector in multiple view helpers ZF2014-03, tiene un vector potencial de tipo cross site scripting en múltiples asistentes de vista. • http://www.openwall.com/lists/oss-security/2014/07/11/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 13EXPL: 0CVE-2015-1555
https://notcve.org/view.php?id=CVE-2015-1555
07 Aug 2017 — Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators. Zend/Session/SessionManager en Zend Framework 2.2.x en versiones anteriores a 2.2.9, 2.3.x en versiones anteriores a 2.3.4 permite que atacantes remotos creen sesiones válidas sin emplear validadores de sesión. • http://framework.zend.com/security/advisory/ZF2015-01 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 92%CPEs: 10EXPL: 7CVE-2016-10034 – PHPMailer < 5.2.20 with Exim MTA - Remote Code Execution
https://notcve.org/view.php?id=CVE-2016-10034
30 Dec 2016 — The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address. La función setFrom en el adaptador Sendmail en el componente zend-mail en versiones anteriores a 2.4.11, 2.5.x, 2.6.x y 2.7.x en versiones anteriores a 2.7.2 y Zend Framework en... • https://packetstorm.news/files/id/140349 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 25EXPL: 0CVE-2015-5723 – Debian Security Advisory 3369-1
https://notcve.org/view.php?id=CVE-2015-5723
07 Oct 2015 — Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code. Doctrine Annotations en versiones anteriores a 1.2.7, Cach... • http://framework.zend.com/security/advisory/ZF2015-07 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 7%CPEs: 154EXPL: 7CVE-2015-5161 – Zend Framework 2.4.2 - PHP FPM XML eXternal Entity Injection
https://notcve.org/view.php?id=CVE-2015-5161
13 Aug 2015 — The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters. Vulnerabilidad en el Zend_Xml_Security::scan en ZendXml en versiones anteriores a 1.0.1 y Zend Framework en versiones anteriores a 1.12.14, 2.x en versiones anteriores ... • https://packetstorm.news/files/id/133068 •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2015-3154 – Debian Security Advisory 3265-1
https://notcve.org/view.php?id=CVE-2015-3154
20 May 2015 — CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email. Una vulnerabilidad de inyección de tipo CRLF en Zend\Mail (Zend_Mail) en Zend Framework versiones anteriores a 1.12.12, versiones 2.x anteriores a 2.3.8 y versiones 2.4.x anteriores a 2.4.1, permite a atacantes remotos inyectar encabeza... • http://framework.zend.com/security/advisory/ZF2015-04 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 1CVE-2014-8089 – Debian Security Advisory 3265-1
https://notcve.org/view.php?id=CVE-2014-8089
30 Mar 2015 — SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. Una vulnerabilidad de inyección SQL en Zend Framework versiones anteriores a 1.12.9, versiones 2.2.x anteriores a 2.2.8 y versiones 2.3.x anteriores a 2.3.3, cuando se usa la extensión PHP sqlsrv, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio de un byte null. XML eXter... • http://framework.zend.com/security/advisory/ZF2014-06 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 21EXPL: 0CVE-2014-8088 – Mandriva Linux Security Advisory 2014-216
https://notcve.org/view.php?id=CVE-2014-8088
22 Oct 2014 — The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. (1) La clase Zend_Ldap en Zend anterior a 1.12.9 y (2) el componente Zend\Ldap en Zend 2.x anterior a 2.2.8 y 2.3.x anterior a 2.3.3 permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un byte nulo, lo que provoca un... • http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141070.html • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2014-2682 – Mandriva Linux Security Advisory 2014-072
https://notcve.org/view.php?id=CVE-2014-2682
09 Apr 2014 — Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an... • http://advisories.mageia.org/MGASA-2014-0151.html • CWE-19: Data Processing Errors •