Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/51134?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "type": "composer", "namespace": "zendframework", "name": "zendframework1", "version": "1.12.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.12.20", "latest_non_vulnerable_version": "1.12.20", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37916?format=api", "vulnerability_id": "VCID-2ncq-wptr-k3ha", "summary": "SQL Injection\nPotential SQL injection vector using null byte for PDO (MsSql, SQLite).", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-08", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2015-08" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52374?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16" } ], "aliases": [ "ZF2015-08" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2ncq-wptr-k3ha" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38158?format=api", "vulnerability_id": "VCID-2xx4-77e9-pfbb", "summary": "Potential SQL injection\nThe implementation of `ORDER BY` and `GROUP BY` in `Zend_Db_Select` of ZF1 is vulnerable by the following SQL injection.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2016-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2016-02" }, { "reference_url": "https://github.com/zendframework/zf1/commit/bf3f40605be3d8f136a07ae991079a7dcb34d967", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/zendframework/zf1/commit/bf3f40605be3d8f136a07ae991079a7dcb34d967" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52823?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-rc3w-5r97-k3b3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.19" } ], "aliases": [ "ZF2016-02" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2xx4-77e9-pfbb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37848?format=api", "vulnerability_id": "VCID-5bm4-grk6-w7hk", "summary": "CRLF Injection\nPotential CRLF injection attacks in mail and HTTP headers.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2015-04", "reference_id": "", "reference_type": "", "scores": [], "url": "http://framework.zend.com/security/advisory/ZF2015-04" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3154", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00274", "scoring_system": "epss", "scoring_elements": "0.51029", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3154" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-04", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2015-04" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-3154.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-3154.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-3154.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-3154.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-http/CVE-2015-3154.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-http/CVE-2015-3154.yaml" }, { "reference_url": "https://github.com/zendframework/zendframework", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3154", "reference_id": "CVE-2015-3154", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3154" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52278?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.12", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.12" } ], "aliases": [ "CVE-2015-3154", "GHSA-5957-5crx-79jx" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5bm4-grk6-w7hk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55313?format=api", "vulnerability_id": "VCID-649h-2f2f-nbam", "summary": "ZendFramework potential XML eXternal Entity injection vectors\nNumerous components utilizing PHP's `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-01", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-01" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-01.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-01.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-mhpx-3rv8-wrjm", "reference_id": "GHSA-mhpx-3rv8-wrjm", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mhpx-3rv8-wrjm" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51732?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.4" } ], "aliases": [ "GHSA-mhpx-3rv8-wrjm" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-649h-2f2f-nbam" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37762?format=api", "vulnerability_id": "VCID-6xpr-93ef-27cu", "summary": "Improper Authentication\nThe (1) `Zend_Ldap` class in Zend and (2) `Zend\u2028dap` component in Zend allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.", "references": [ { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141070.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141070.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141106.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141106.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2014-8088", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00608", "scoring_system": "epss", "scoring_elements": "0.70101", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-8088" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97038", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/97038" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-05" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8088.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8088.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8088.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8088.yaml" }, { "reference_url": "https://github.com/zendframework/zendframework", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework" }, { "reference_url": "https://github.com/zendframework/zendframework/commit/a4222a6c1dc809f0f32fdafcd1ac4d583a075f2f", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework/commit/a4222a6c1dc809f0f32fdafcd1ac4d583a075f2f" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3265", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3265" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2014/10/10/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2014/10/10/5" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html" }, { "reference_url": "http://www.securityfocus.com/bid/70378", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/70378" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8088", "reference_id": "CVE-2014-8088", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8088" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51974?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.9" } ], "aliases": [ "CVE-2014-8088", "GHSA-f6rc-rh43-h8gr" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6xpr-93ef-27cu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37948?format=api", "vulnerability_id": "VCID-8atm-865q-mkf3", "summary": "Potential Information Disclosure and Insufficient Entropy vulnerability in `Zend\\Captcha\\Word`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-09", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2015-09" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52407?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17" } ], "aliases": [ "ZF2015-09" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8atm-865q-mkf3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55300?format=api", "vulnerability_id": "VCID-9bm9-b48z-zqcm", "summary": "ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select\nThe implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db = Zend_Db::factory( /* options here */ );\n$select = $db->select()\n->from(array('p' => 'products'))\n->order('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-04", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-04" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-04.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-04.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-2x36-qhx3-7m5f", "reference_id": "GHSA-2x36-qhx3-7m5f", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-2x36-qhx3-7m5f" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51887?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.7" } ], "aliases": [ "GHSA-2x36-qhx3-7m5f" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9bm9-b48z-zqcm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37705?format=api", "vulnerability_id": "VCID-a72a-7k6u-rqgr", "summary": "SQL Injection\nPotential SQL injection in the ORDER implementation of `Zend_Db_Select`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-04", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2014-04" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51887?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.7" } ], "aliases": [ "ZF2014-04" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a72a-7k6u-rqgr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37636?format=api", "vulnerability_id": "VCID-afnn-53q5-wqft", "summary": "Improper Authentication\nPotential security issue in login mechanism of ZendOpenId and Zend_OpenId consumer.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2014-02" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51732?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.4" } ], "aliases": [ "ZF2014-02" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-afnn-53q5-wqft" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55331?format=api", "vulnerability_id": "VCID-b1da-n1u7-43hj", "summary": "ZendFramework1 Potential Insufficient Entropy Vulnerability\nWe discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2016-01", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2016-01" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-8xhv-gqm4-3w99", "reference_id": "GHSA-8xhv-gqm4-3w99", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8xhv-gqm4-3w99" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52645?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18" } ], "aliases": [ "GHSA-8xhv-gqm4-3w99" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-b1da-n1u7-43hj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38482?format=api", "vulnerability_id": "VCID-bjvu-jg9w-mqdd", "summary": "SQL Injection\nThe (1) order and (2) group methods in Zend_Db_Select in the Zend Framework might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern `[\\w]*` in a regular expression.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6233", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01724", "scoring_system": "epss", "scoring_elements": "0.82763", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6233" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2016-02", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2016-02" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2016-6233.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2016-6233.yaml" }, { "reference_url": "https://github.com/zendframework/zendframework", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT" }, { "reference_url": "https://security.gentoo.org/glsa/201804-10", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201804-10" }, { "reference_url": "https://web.archive.org/web/20210123152547/http://www.securityfocus.com/bid/91802", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210123152547/http://www.securityfocus.com/bid/91802" }, { "reference_url": "http://www.securityfocus.com/bid/91802", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/91802" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6233", "reference_id": "CVE-2016-6233", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6233" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52823?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.19", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-rc3w-5r97-k3b3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.19" } ], "aliases": [ "CVE-2016-6233", "GHSA-p9hp-3gpv-52w3" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bjvu-jg9w-mqdd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37473?format=api", "vulnerability_id": "VCID-cp1a-fprd-9fhk", "summary": "Improper Restriction of XML External Entity Reference\nPotential XML eXternal Entity injection vectors in Zend Framework 1 `Zend_Feed` component.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2012-05", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2012-05" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51343?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.1" } ], "aliases": [ "ZF2012-05" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cp1a-fprd-9fhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55284?format=api", "vulnerability_id": "VCID-e9ut-smfp-7yb4", "summary": "Zendframework potential security issue in login mechanism\nUsing the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-02", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-02" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-02.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-02.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-9v78-h226-2rmq", "reference_id": "GHSA-9v78-h226-2rmq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-9v78-h226-2rmq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51732?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.4" } ], "aliases": [ "GHSA-9v78-h226-2rmq" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e9ut-smfp-7yb4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37640?format=api", "vulnerability_id": "VCID-grk8-aj34-hqb4", "summary": "Improper Restriction of XML External Entity Reference\nPotential XXE/XEE attacks using PHP functions: `simplexml_load_*`, `DOMDocument::loadXML`, and `xml_parse`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2014-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51732?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.4" } ], "aliases": [ "ZF2014-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-grk8-aj34-hqb4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55292?format=api", "vulnerability_id": "VCID-h5yf-ahec-gbgx", "summary": "Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability\nIn Zend Framework, Zend_Captcha_Word (v1) and Zend\\Captcha\\Word (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-09", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2015-09" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-09.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-09.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-848f-mph5-9pm9", "reference_id": "GHSA-848f-mph5-9pm9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-848f-mph5-9pm9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52407?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17" } ], "aliases": [ "GHSA-848f-mph5-9pm9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h5yf-ahec-gbgx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55272?format=api", "vulnerability_id": "VCID-j5kg-jzxz-ruam", "summary": "ZendFramework potential XML eXternal Entity injection vectors\n`Zend_Feed_Rss` and `Zend_Feed_Atom` were found to contain potential XML eXternal Entity (XXE) vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or TCP connections.\n\nA similar issue was fixed for 1.11.13 and 1.12.0, in the `Zend_Feed::import()` factory method; however, the reporter of the issue discovered that the individual classes contained similar functionality in their constructors which remained vulnerable.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2012-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2012-05" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-05.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-05.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-4j9x-g4x8-vcmf", "reference_id": "GHSA-4j9x-g4x8-vcmf", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-4j9x-g4x8-vcmf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51343?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.1" } ], "aliases": [ "GHSA-4j9x-g4x8-vcmf" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-j5kg-jzxz-ruam" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38088?format=api", "vulnerability_id": "VCID-n2gy-93nd-gber", "summary": "Potential Insufficient Entropy Vulnerability in ZF1.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2016-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2016-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52645?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18" } ], "aliases": [ "ZF2016-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n2gy-93nd-gber" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37904?format=api", "vulnerability_id": "VCID-njsg-e1w1-9qcy", "summary": "XXE/XEE vulnerability via multibyte payloads\nThere's a flow that allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters. This only apply when running under PHP-FPM in a threaded environment.", "references": [ { "reference_url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5161", "reference_id": "", "reference_type": "", "scores": [], "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5161" }, { "reference_url": "http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://legalhackers.com/advisories/zend-framework-XXE-vuln.txt" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164409.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165147.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165173.html" }, { "reference_url": "http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/133068/Zend-Framework-2.4.2-1.12.13-XXE-Injection.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5161", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.39093", "scoring_system": "epss", "scoring_elements": "0.97355", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5161" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5161", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5161" }, { "reference_url": "http://seclists.org/fulldisclosure/2015/Aug/46", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2015/Aug/46" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-06", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2015-06" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5161.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5161.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendxml/CVE-2015-5161.yaml" }, { "reference_url": "https://github.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/ZendXml/commit/79f478fa2af85ce1fc18ac132dee5aa714c3b532" }, { "reference_url": "https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1/commit/ff7edddf1410b44b5ead857c02698aad9f748d1b" }, { "reference_url": "https://github.com/zendframework/zf1/issues/393", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1/issues/393" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5161", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5161" }, { "reference_url": "https://web.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200228055156/http://www.securityfocus.com/bid/76177" }, { "reference_url": "https://www.exploit-db.com/exploits/37765", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.exploit-db.com/exploits/37765" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3340", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3340" }, { "reference_url": "http://www.securityfocus.com/bid/76177", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/76177" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/37765.txt", "reference_id": "CVE-2015-5161", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/37765.txt" }, { "reference_url": "http://framework.zend.com/security/advisory/ZF2015-06", "reference_id": "CVE-2015-5161;OSVDB-125783", "reference_type": "exploit", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2015-06" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/38573.txt", "reference_id": "CVE-2015-5161;OSVDB-125783", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/38573.txt" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52357?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.14", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.14" } ], "aliases": [ "CVE-2015-5161", "GHSA-xp8p-9rq5-4wgv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-njsg-e1w1-9qcy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55312?format=api", "vulnerability_id": "VCID-ps73-776n-zffn", "summary": "Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)\nThe PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.\n\nWe tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-08", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2015-08" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/advisories/GHSA-v42g-7q2x-cw32", "reference_id": "GHSA-v42g-7q2x-cw32", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v42g-7q2x-cw32" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52374?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16" } ], "aliases": [ "GHSA-v42g-7q2x-cw32" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ps73-776n-zffn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37953?format=api", "vulnerability_id": "VCID-q73m-16a9-rkgx", "summary": "Potential Information Disclosure and Insufficient Entropy in Zend\\Captcha\\Word\nZend generates a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. The selection is performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This can potentially lead to information disclosure should an attacker be able to brute force the random number generation.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2015-09", "reference_id": "", "reference_type": "", "scores": [], "url": "http://framework.zend.com/security/advisory/ZF2015-09" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52407?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.17", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17" } ], "aliases": [ "GMS-2015-49" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q73m-16a9-rkgx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38135?format=api", "vulnerability_id": "VCID-q74z-645k-c7dk", "summary": "Security Misconfiguration Vulnerability\nDoctrine uses `mkdir($cacheDirectory )` to create caches directories. if your application runs with a umask of", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2015-07", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2015-07" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5723", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00033", "scoring_system": "epss", "scoring_elements": "0.10216", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5723" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2015-07", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2015-07" }, { "reference_url": "https://github.com/aws/aws-sdk-php/releases/tag/3.2.1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/aws/aws-sdk-php/releases/tag/3.2.1" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5723", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5723" }, { "reference_url": "https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html" }, { "reference_url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5723", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5723" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3369", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3369" }, { "reference_url": "http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52374?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16" } ], "aliases": [ "CVE-2015-5723", "GHSA-pw5c-xqf2-6xc2" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-q74z-645k-c7dk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37751?format=api", "vulnerability_id": "VCID-r5y8-nc2w-kqde", "summary": "SQL Injection\nSQL injection vector when manually quoting values for `sqlsrv` extension, using null byte.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2014-06", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2014-06" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2014-8089", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01121", "scoring_system": "epss", "scoring_elements": "0.78587", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-8089" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151277", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151277" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2681" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2682" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2683" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2684" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2685" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4914" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8089" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3154" }, { "reference_url": "http://seclists.org/oss-sec/2014/q4/276", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/oss-sec/2014/q4/276" }, { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-06", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-06" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml" }, { "reference_url": "http://www.securityfocus.com/bid/70011", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/70011" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8089", "reference_id": "CVE-2014-8089", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8089" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51974?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.9" } ], "aliases": [ "CVE-2014-8089", "GHSA-qh9w-r7g5-q939" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r5y8-nc2w-kqde" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38208?format=api", "vulnerability_id": "VCID-rc3w-5r97-k3b3", "summary": "Potential SQL injection in ORDER and GROUP functions\nThe implementation of ORDER BY and GROUP BY in `Zend_Db_Select` is prone to SQL injection when a combination of SQL expressions and comments are used.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2016-03", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2016-03" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52880?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.20", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.20" } ], "aliases": [ "ZF2016-03" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rc3w-5r97-k3b3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38087?format=api", "vulnerability_id": "VCID-sjw9-2fwe-5ybg", "summary": "Potential Insufficient Entropy\nThere are several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. Moreover, there's a potential security issue in the usage of the `openssl_random_pseudo_bytes()` function in `Zend_Crypt_Math::randBytes`, reported in PHP BUG #70014, and the security implications reported in a discussion on the `random_compat` library.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2016-01", "reference_id": "", "reference_type": "", "scores": [], "url": "http://framework.zend.com/security/advisory/ZF2016-01" }, { "reference_url": "https://bugs.php.net/bug.php?id=70014", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.php.net/bug.php?id=70014" }, { "reference_url": "https://github.com/paragonie/random_compat/issues/96", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/paragonie/random_compat/issues/96" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52645?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.18", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18" } ], "aliases": [ "ZF2016-11" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sjw9-2fwe-5ybg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38136?format=api", "vulnerability_id": "VCID-uvgx-4m6v-2bg7", "summary": "SQL injection vector using null byte for PDO\nThe PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection. This only impacts MsSql and SQLite adapters.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2015-08", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2015-08" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7695", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02248", "scoring_system": "epss", "scoring_elements": "0.84884", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7695" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7695", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7695" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3369", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3369" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2015/09/30/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2015/09/30/6" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2015/09/30/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2015/09/30/8" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2015/10/11/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2015/10/11/3" }, { "reference_url": "http://www.securityfocus.com/bid/76784", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securityfocus.com/bid/76784" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52374?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16" } ], "aliases": [ "CVE-2015-7695", "GHSA-2hvh-c5c2-vj85" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uvgx-4m6v-2bg7" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37381?format=api", "vulnerability_id": "VCID-24xb-s5fu-xuc2", "summary": "Cross-site Scripting\nPotential XSS vector in `Zend_Service_ReCaptcha_MailHide`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-05", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-05" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-05" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-24xb-s5fu-xuc2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37373?format=api", "vulnerability_id": "VCID-46j8-n7cg-3feu", "summary": "Cross-site Scripting\nXSS vector in `Zend_Filter_StripTags`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2009-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2009-02" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2009-02" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-46j8-n7cg-3feu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/111046?format=api", "vulnerability_id": "VCID-4f52-bffk-eug2", "summary": "Zend Framework XEE Vulnerability\n(1) `Zend_Dom`, (2) `Zend_Feed`, (3) `Zend_Soap`, and (4) `Zend_XmlRpc` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.", "references": [ { "reference_url": "http://framework.zend.com/security/advisory/ZF2012-02", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2012-02" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6532", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00474", "scoring_system": "epss", "scoring_elements": "0.65101", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6532" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6532", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6532" }, { "reference_url": "https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81801?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.11.13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.11.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "CVE-2012-6532", "GHSA-jh4x-4wmf-67pr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4f52-bffk-eug2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37439?format=api", "vulnerability_id": "VCID-4y4f-z31m-dqaz", "summary": "Cross-Site Scripting\nPotential XSS in Development Environment Error View Script.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2011-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2011-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2011-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4y4f-z31m-dqaz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37383?format=api", "vulnerability_id": "VCID-6j4n-cucb-5fdy", "summary": "Cross-site Scripting\nPotential XSS vector in `Zend_Dojo_View_Helper_Editor`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-02" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-02" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6j4n-cucb-5fdy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37380?format=api", "vulnerability_id": "VCID-758r-rg88-eqga", "summary": "Cross-site Scripting\nPotential XSS vectors due to inconsistent encodings.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-758r-rg88-eqga" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37451?format=api", "vulnerability_id": "VCID-bm9s-eke4-tfhk", "summary": "Improper Restriction of XML External Entity Reference\nLocal file disclosure via XXE injection in `Zend_XmlRpc`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2012-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2012-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2012-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bm9s-eke4-tfhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37382?format=api", "vulnerability_id": "VCID-cp8b-e8wm-kfb3", "summary": "Cross-Site Scripting\nPotential Security Issues in Bundled Dojo Library.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-06", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-06" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-06" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cp8b-e8wm-kfb3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37372?format=api", "vulnerability_id": "VCID-e2nf-wm5h-fqav", "summary": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')\nFile Inclusion vector in `Zend_View::setScriptPath()` and `render()`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2009-01", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2009-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2009-01" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e2nf-wm5h-fqav" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37384?format=api", "vulnerability_id": "VCID-e98a-dehh-ybbe", "summary": "Cross-site Scripting\nPotential XSS vector in `Zend_Filter_StripTags` when comments allowed.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-03", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-03" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-03" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e98a-dehh-ybbe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37405?format=api", "vulnerability_id": "VCID-m1p7-zwwq-jbdg", "summary": "Potential SQL Injection Vector When Using `PDO_MySql`.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2011-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2011-02" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2011-02" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m1p7-zwwq-jbdg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/111422?format=api", "vulnerability_id": "VCID-nkxr-brbk-x7dj", "summary": "Zend Framework XEE Vulnerability\n(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6531", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00905", "scoring_system": "epss", "scoring_elements": "0.76121", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6531" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6531", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6531" }, { "reference_url": "https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt" }, { "reference_url": "http://www.debian.org/security/2012/dsa-2505", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2012/dsa-2505" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/26/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/26/2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/26/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/26/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/27/2" }, { "reference_url": "http://framework.zend.com/security/advisory/ZF2012-01", "reference_id": "OSVDB-83221;CVE-2012-3363", "reference_type": "exploit", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2012-01" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81801?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.11.13", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.11.13" }, { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "CVE-2012-6531", "GHSA-h5p3-7mg6-hgj4" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nkxr-brbk-x7dj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37461?format=api", "vulnerability_id": "VCID-nyxj-v79u-qka4", "summary": "Improper Restriction of XML External Entity Reference\nDenial of Service vector via XEE injection.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2012-02", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2012-02" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2012-02" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nyxj-v79u-qka4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37388?format=api", "vulnerability_id": "VCID-v3p7-aj4a-33d5", "summary": "Cross-Site Scripting\nPotential Security Issues in Bundled Dojo Library.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2010-07", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2010-07" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "ZF2010-07" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v3p7-aj4a-33d5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44186?format=api", "vulnerability_id": "VCID-wbb2-mubf-ukhk", "summary": "Zend Framework XXE Vulnerability\nZend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.", "references": [ { "reference_url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html" }, { "reference_url": "http://openwall.com/lists/oss-security/2013/03/25/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://openwall.com/lists/oss-security/2013/03/25/2" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3363", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.55118", "scoring_system": "epss", "scoring_elements": "0.98097", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3363" }, { "reference_url": "https://github.com/zendframework/zf1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1" }, { "reference_url": "https://github.com/zendframework/zf1/commit/281a3251d71ed40a5289ec4afc355eea8e014dc5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zf1/commit/281a3251d71ed40a5289ec4afc355eea8e014dc5" }, { "reference_url": "https://moodle.org/mod/forum/discuss.php?d=225345", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://moodle.org/mod/forum/discuss.php?d=225345" }, { "reference_url": "https://web.archive.org/web/20170223044943/http://www.securitytracker.com/id?1027208", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20170223044943/http://www.securitytracker.com/id?1027208" }, { "reference_url": "https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt" }, { "reference_url": "http://www.debian.org/security/2012/dsa-2505", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2012/dsa-2505" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/26/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/26/2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/26/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/26/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/06/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/06/27/2" }, { "reference_url": "http://www.securitytracker.com/id?1027208", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.securitytracker.com/id?1027208" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3363", "reference_id": "CVE-2012-3363", "reference_type": "", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3363" }, { "reference_url": "https://github.com/advisories/GHSA-7pg4-5233-82jv", "reference_id": "GHSA-7pg4-5233-82jv", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7pg4-5233-82jv" }, { "reference_url": "http://framework.zend.com/security/advisory/ZF2012-01", "reference_id": "OSVDB-83221;CVE-2012-3363", "reference_type": "exploit", "scores": [ { "value": "7.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://framework.zend.com/security/advisory/ZF2012-01" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/19408.txt", "reference_id": "OSVDB-83221;CVE-2012-3363", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/19408.txt" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63560?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.11.12", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.11.12" }, { "url": "http://public2.vulnerablecode.io/api/packages/51134?format=api", "purl": "pkg:composer/zendframework/zendframework1@1.12.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ncq-wptr-k3ha" }, { "vulnerability": "VCID-2xx4-77e9-pfbb" }, { "vulnerability": "VCID-5bm4-grk6-w7hk" }, { "vulnerability": "VCID-649h-2f2f-nbam" }, { "vulnerability": "VCID-6xpr-93ef-27cu" }, { "vulnerability": "VCID-8atm-865q-mkf3" }, { "vulnerability": "VCID-9bm9-b48z-zqcm" }, { "vulnerability": "VCID-a72a-7k6u-rqgr" }, { "vulnerability": "VCID-afnn-53q5-wqft" }, { "vulnerability": "VCID-b1da-n1u7-43hj" }, { "vulnerability": "VCID-bjvu-jg9w-mqdd" }, { "vulnerability": "VCID-cp1a-fprd-9fhk" }, { "vulnerability": "VCID-e9ut-smfp-7yb4" }, { "vulnerability": "VCID-grk8-aj34-hqb4" }, { "vulnerability": "VCID-h5yf-ahec-gbgx" }, { "vulnerability": "VCID-j5kg-jzxz-ruam" }, { "vulnerability": "VCID-n2gy-93nd-gber" }, { "vulnerability": "VCID-njsg-e1w1-9qcy" }, { "vulnerability": "VCID-ps73-776n-zffn" }, { "vulnerability": "VCID-q73m-16a9-rkgx" }, { "vulnerability": "VCID-q74z-645k-c7dk" }, { "vulnerability": "VCID-r5y8-nc2w-kqde" }, { "vulnerability": "VCID-rc3w-5r97-k3b3" }, { "vulnerability": "VCID-sjw9-2fwe-5ybg" }, { "vulnerability": "VCID-uvgx-4m6v-2bg7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" } ], "aliases": [ "CVE-2012-3363", "GHSA-7pg4-5233-82jv" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wbb2-mubf-ukhk" } ], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.0" }