Search for packages
| purl | pkg:composer/zendframework/zendframework@2.5.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-bha1-43g9-z7f2
Aliases: CVE-2015-7503 GHSA-pm9m-w23q-5967 |
Affected by 0 other vulnerabilities. |
|
|
VCID-ha1v-jhhj-xuay
Aliases: CVE-2015-5161 GHSA-xp8p-9rq5-4wgv |
security update |
Affected by 0 other vulnerabilities. |
|
VCID-s7mx-8xh2-w3ca
Aliases: GMS-2015-48 |
Potential Information Disclosure and Insufficient Entropy in Zend\Captcha\Word Zend generates a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. The selection is performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This can potentially lead to information disclosure should an attacker be able to brute force the random number generation. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4bfz-jkrd-4kfn | Zendframework URL Rewrite vulnerability |
GHSA-fh7r-58q4-6387
|
| VCID-b5m8-jc12-1yc3 | Potential Information Disclosure and Insufficient Entropy vulnerability in `Zend\Captcha\Word`. |
ZF2015-09
|
| VCID-cpmt-fwxa-67br | Remote code execution in zend-mail via Sendmail adapter A malicious user may be able to inject arbitrary parameters to the system Sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability. |
ZF2016-04
|
| VCID-gznz-tm3a-nfgz | URL Redirection to Untrusted Site (Open Redirect) URL Rewrite vulnerability. |
ZF2018-01
|