Search for packages
| purl | pkg:composer/zendframework/zendframework1@1.11.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-cp1a-fprd-9fhk
Aliases: ZF2012-05 |
Improper Restriction of XML External Entity Reference Potential XML eXternal Entity injection vectors in Zend Framework 1 `Zend_Feed` component. |
Affected by 27 other vulnerabilities. |
|
VCID-j5kg-jzxz-ruam
Aliases: GHSA-4j9x-g4x8-vcmf |
ZendFramework potential XML eXternal Entity injection vectors `Zend_Feed_Rss` and `Zend_Feed_Atom` were found to contain potential XML eXternal Entity (XXE) vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or TCP connections. A similar issue was fixed for 1.11.13 and 1.12.0, in the `Zend_Feed::import()` factory method; however, the reporter of the issue discovered that the individual classes contained similar functionality in their constructors which remained vulnerable. |
Affected by 0 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-m1dk-ptr5-23c2
Aliases: GHSA-qf36-fx9f-232x |
ZendFramework potential SQL Injection Vector When Using PDO_MySql Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here: http://bugs.php.net/bug.php?id=47802 The PHP Group included a feature in PHP 5.3.6+ that allows any character set information to be passed as part of the DSN in PDO to allow both the database as well as the C-level driver to be aware of which charset is in use which is of special importance when PDO's quoting mechanisms are utilized, which Zend Framework also relies on. |
Affected by 0 other vulnerabilities. |
|
VCID-m1p7-zwwq-jbdg
Aliases: ZF2011-02 |
Potential SQL Injection Vector When Using `PDO_MySql`. |
Affected by 30 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||