Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/198301?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/198301?format=api", "purl": "pkg:composer/zendframework/zend-view@2.2.3", "type": "composer", "namespace": "zendframework", "name": "zend-view", "version": "2.2.3", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.2.7", "latest_non_vulnerable_version": "2.3.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55319?format=api", "vulnerability_id": "VCID-bfmh-w43u-k7bq", "summary": "ZendFramework has potential Cross-site Scripting vector in multiple view helpers\nMany Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors.\n\nVulnerable view helpers include:\n\n- All `Zend\\Form` view helpers.\n- Most `Zend\\Navigation` (aka `Zend\\View\\Helper\\Navigation\\*`) view helpers.\n- All \"HTML Element\" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`.\n- `Zend\\View\\Helper\\Gravatar`", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-03", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://framework.zend.com/security/advisory/ZF2014-03" }, { "reference_url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-view/ZF2014-03.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-view/ZF2014-03.yaml" }, { "reference_url": "https://github.com/zendframework/zendframework/commit/12f89b587cd23dd781cde25c9dd2da75d8f829d7", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework/commit/12f89b587cd23dd781cde25c9dd2da75d8f829d7" }, { "reference_url": "https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea" }, { "reference_url": "https://github.com/zendframework/zendframework/commit/6742ddad7a7923163cea6dd58d27d0e946a402d1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework/commit/6742ddad7a7923163cea6dd58d27d0e946a402d1" }, { "reference_url": "https://github.com/zendframework/zendframework/commit/ec6c0468514c111a244552cfb7cf575a726e017e", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zendframework/commit/ec6c0468514c111a244552cfb7cf575a726e017e" }, { "reference_url": "https://github.com/zendframework/zend-view", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/zendframework/zend-view" }, { "reference_url": "https://github.com/advisories/GHSA-m7hr-j867-3f34", "reference_id": "GHSA-m7hr-j867-3f34", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-m7hr-j867-3f34" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51750?format=api", "purl": "pkg:composer/zendframework/zend-view@2.2.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-view@2.2.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/51751?format=api", "purl": "pkg:composer/zendframework/zend-view@2.3.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-view@2.3.1" } ], "aliases": [ "GHSA-m7hr-j867-3f34" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bfmh-w43u-k7bq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37641?format=api", "vulnerability_id": "VCID-eezd-92tv-mkdf", "summary": "Cross-site Scripting\nPotential XSS vector in multiple view helpers.", "references": [ { "reference_url": "https://framework.zend.com/security/advisory/ZF2014-03", "reference_id": "", "reference_type": "", "scores": [], "url": "https://framework.zend.com/security/advisory/ZF2014-03" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51750?format=api", "purl": "pkg:composer/zendframework/zend-view@2.2.7", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-view@2.2.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/51751?format=api", "purl": "pkg:composer/zendframework/zend-view@2.3.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-view@2.3.1" } ], "aliases": [ "ZF2014-03" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-eezd-92tv-mkdf" } ], "fixing_vulnerabilities": [], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-view@2.2.3" }