{"url":"http://public2.vulnerablecode.io/api/packages/201701?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.15","type":"composer","namespace":"zendframework","name":"zendframework1","version":"1.12.15","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.12.20","latest_non_vulnerable_version":"1.12.20","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37916?format=json","vulnerability_id":"VCID-2ncq-wptr-k3ha","summary":"SQL Injection\nPotential SQL injection vector using null byte for PDO (MsSql, SQLite).","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2015-08","reference_id":"","reference_type":"","scores":[],"url":"https://framework.zend.com/security/advisory/ZF2015-08"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52374?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-8atm-865q-mkf3"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-h5yf-ahec-gbgx"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-q73m-16a9-rkgx"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16"}],"aliases":["ZF2015-08"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2ncq-wptr-k3ha"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38158?format=json","vulnerability_id":"VCID-2xx4-77e9-pfbb","summary":"Potential SQL injection\nThe implementation of `ORDER BY` and `GROUP BY` in `Zend_Db_Select` of ZF1 is vulnerable by the following SQL injection.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-02","reference_id":"","reference_type":"","scores":[],"url":"https://framework.zend.com/security/advisory/ZF2016-02"},{"reference_url":"https://github.com/zendframework/zf1/commit/bf3f40605be3d8f136a07ae991079a7dcb34d967","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/zendframework/zf1/commit/bf3f40605be3d8f136a07ae991079a7dcb34d967"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52823?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-rc3w-5r97-k3b3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.19"}],"aliases":["ZF2016-02"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2xx4-77e9-pfbb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37948?format=json","vulnerability_id":"VCID-8atm-865q-mkf3","summary":"Potential Information Disclosure and Insufficient Entropy vulnerability in `Zend\\Captcha\\Word`.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2015-09","reference_id":"","reference_type":"","scores":[],"url":"https://framework.zend.com/security/advisory/ZF2015-09"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52407?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17"}],"aliases":["ZF2015-09"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8atm-865q-mkf3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55331?format=json","vulnerability_id":"VCID-b1da-n1u7-43hj","summary":"ZendFramework1 Potential Insufficient Entropy Vulnerability\nWe discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-01","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2016-01"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-01.yaml"},{"reference_url":"https://github.com/zendframework/zf1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zf1"},{"reference_url":"https://github.com/advisories/GHSA-8xhv-gqm4-3w99","reference_id":"GHSA-8xhv-gqm4-3w99","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8xhv-gqm4-3w99"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52645?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-rc3w-5r97-k3b3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18"}],"aliases":["GHSA-8xhv-gqm4-3w99"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-b1da-n1u7-43hj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38482?format=json","vulnerability_id":"VCID-bjvu-jg9w-mqdd","summary":"SQL Injection\nThe (1) order and (2) group methods in Zend_Db_Select in the Zend Framework might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern `[\\w]*` in a regular expression.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6233","reference_id":"","reference_type":"","scores":[{"value":"0.01724","scoring_system":"epss","scoring_elements":"0.82763","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01724","scoring_system":"epss","scoring_elements":"0.82788","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-6233"},{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-02","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2016-02"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2016-6233.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2016-6233.yaml"},{"reference_url":"https://github.com/zendframework/zendframework","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zendframework"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2JUKFTI6ABK7ZN7IEAGPCLAHCFANMID2"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N27AV6AL6B4KGEP3VIMIHQ5LFAKF5FTU"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UR5HXNGIUSSIZKMSZYMPBEPZEZTYFTIT"},{"reference_url":"https://security.gentoo.org/glsa/201804-10","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.gentoo.org/glsa/201804-10"},{"reference_url":"https://web.archive.org/web/20210123152547/http://www.securityfocus.com/bid/91802","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20210123152547/http://www.securityfocus.com/bid/91802"},{"reference_url":"http://www.securityfocus.com/bid/91802","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/91802"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6233","reference_id":"CVE-2016-6233","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6233"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52823?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-rc3w-5r97-k3b3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.19"}],"aliases":["CVE-2016-6233","GHSA-p9hp-3gpv-52w3"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bjvu-jg9w-mqdd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55290?format=json","vulnerability_id":"VCID-c8kp-n8m3-2khe","summary":"Zendframework1 Potential SQL injection in ORDER and GROUP functions\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.\n\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection:\n```\n$db = Zend_Db::factory(/* options here */);\n$select = new Zend_Db_Select($db);\n$select->from('p');\n$select->order(\"MD5(\\\"a(\\\");DELETE FROM p2; #)\"); // same with group()\n```\nThe above $select will render the following SQL statement:\n```\nSELECT `p`.* FROM `p` ORDER BY MD5(\"a(\");DELETE FROM p2; #) ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"p\" ORDER BY \"MD5(\"\"a(\"\");DELETE FROM p2; #)\" ASC\n```\nThis security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.\n\nAs a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking Zend_Db. You can use the Zend_Db_Select::quoteInto() method to filter the input data, as shown in this example:\n```\n$db    = Zend_Db::factory(...);\n$input = \"MD5(\\\"a(\\\");DELETE FROM p2; #)\"; // user input can be an attack\n$order = $db->quoteInto(\"SQL statement for ORDER\", $input);\n\n$select = new Zend_Db_Select($db);\n$select->from('p');\n$select->order($order); // same with group()\n```","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-03","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2016-03"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-03.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2016-03.yaml"},{"reference_url":"https://github.com/zendframework/zf1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zf1"},{"reference_url":"https://github.com/advisories/GHSA-6fqw-j3vm-7f66","reference_id":"GHSA-6fqw-j3vm-7f66","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6fqw-j3vm-7f66"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52880?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.20","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.20"}],"aliases":["GHSA-6fqw-j3vm-7f66"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c8kp-n8m3-2khe"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55292?format=json","vulnerability_id":"VCID-h5yf-ahec-gbgx","summary":"Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability\nIn Zend Framework, Zend_Captcha_Word (v1) and Zend\\Captcha\\Word (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2015-09","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2015-09"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-09.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-09.yaml"},{"reference_url":"https://github.com/zendframework/zf1","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zf1"},{"reference_url":"https://github.com/advisories/GHSA-848f-mph5-9pm9","reference_id":"GHSA-848f-mph5-9pm9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-848f-mph5-9pm9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52407?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17"}],"aliases":["GHSA-848f-mph5-9pm9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-h5yf-ahec-gbgx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38088?format=json","vulnerability_id":"VCID-n2gy-93nd-gber","summary":"Potential Insufficient Entropy Vulnerability in ZF1.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-01","reference_id":"","reference_type":"","scores":[],"url":"https://framework.zend.com/security/advisory/ZF2016-01"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52645?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-rc3w-5r97-k3b3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18"}],"aliases":["ZF2016-01"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n2gy-93nd-gber"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/55312?format=json","vulnerability_id":"VCID-ps73-776n-zffn","summary":"Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)\nThe PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection.\n\nWe tested and verified the null byte injection using pdo_dblib (FreeTDS) on a Linux environment to access a remote Microsoft SQL Server, and also tested against and noted the vector against pdo_sqlite.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2015-08","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2015-08"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2015-08.yaml"},{"reference_url":"https://github.com/zendframework/zf1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zf1"},{"reference_url":"https://github.com/advisories/GHSA-v42g-7q2x-cw32","reference_id":"GHSA-v42g-7q2x-cw32","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-v42g-7q2x-cw32"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52374?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-8atm-865q-mkf3"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-h5yf-ahec-gbgx"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-q73m-16a9-rkgx"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16"}],"aliases":["GHSA-v42g-7q2x-cw32"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ps73-776n-zffn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37953?format=json","vulnerability_id":"VCID-q73m-16a9-rkgx","summary":"Potential Information Disclosure and Insufficient Entropy in Zend\\Captcha\\Word\nZend generates a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. The selection is performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This can potentially lead to information disclosure should an attacker be able to brute force the random number generation.","references":[{"reference_url":"http://framework.zend.com/security/advisory/ZF2015-09","reference_id":"","reference_type":"","scores":[],"url":"http://framework.zend.com/security/advisory/ZF2015-09"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52407?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.17","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.17"}],"aliases":["GMS-2015-49"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q73m-16a9-rkgx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38135?format=json","vulnerability_id":"VCID-q74z-645k-c7dk","summary":"Security Misconfiguration Vulnerability\nDoctrine uses `mkdir($cacheDirectory )` to create caches directories. if your application runs with a umask of","references":[{"reference_url":"http://framework.zend.com/security/advisory/ZF2015-07","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://framework.zend.com/security/advisory/ZF2015-07"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5723","reference_id":"","reference_type":"","scores":[{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10261","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00033","scoring_system":"epss","scoring_elements":"0.10216","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5723"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695"},{"reference_url":"https://framework.zend.com/security/advisory/ZF2015-07","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://framework.zend.com/security/advisory/ZF2015-07"},{"reference_url":"https://github.com/aws/aws-sdk-php/releases/tag/3.2.1","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/aws-sdk-php/releases/tag/3.2.1"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5723","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5723"},{"reference_url":"https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"},{"reference_url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5723","reference_id":"","reference_type":"","scores":[],"url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5723"},{"reference_url":"http://www.debian.org/security/2015/dsa-3369","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2015/dsa-3369"},{"reference_url":"http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52374?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-8atm-865q-mkf3"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-h5yf-ahec-gbgx"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-q73m-16a9-rkgx"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16"}],"aliases":["CVE-2015-5723","GHSA-pw5c-xqf2-6xc2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q74z-645k-c7dk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38208?format=json","vulnerability_id":"VCID-rc3w-5r97-k3b3","summary":"Potential SQL injection in ORDER and GROUP functions\nThe implementation of ORDER BY and GROUP BY in `Zend_Db_Select` is prone to SQL injection when a combination of SQL expressions and comments are used.","references":[{"reference_url":"https://framework.zend.com/security/advisory/ZF2016-03","reference_id":"","reference_type":"","scores":[],"url":"https://framework.zend.com/security/advisory/ZF2016-03"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52880?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.20","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.20"}],"aliases":["ZF2016-03"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rc3w-5r97-k3b3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38087?format=json","vulnerability_id":"VCID-sjw9-2fwe-5ybg","summary":"Potential Insufficient Entropy\nThere are several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. Moreover, there's a potential security issue in the usage of the `openssl_random_pseudo_bytes()` function in `Zend_Crypt_Math::randBytes`, reported in PHP BUG #70014, and the security implications reported in a discussion on the `random_compat` library.","references":[{"reference_url":"http://framework.zend.com/security/advisory/ZF2016-01","reference_id":"","reference_type":"","scores":[],"url":"http://framework.zend.com/security/advisory/ZF2016-01"},{"reference_url":"https://bugs.php.net/bug.php?id=70014","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.php.net/bug.php?id=70014"},{"reference_url":"https://github.com/paragonie/random_compat/issues/96","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/paragonie/random_compat/issues/96"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52645?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-rc3w-5r97-k3b3"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.18"}],"aliases":["ZF2016-11"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sjw9-2fwe-5ybg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38136?format=json","vulnerability_id":"VCID-uvgx-4m6v-2bg7","summary":"SQL injection vector using null byte for PDO\nThe PDO adapters of Zend Framework 1 do not filter null bytes values in SQL statements. A PDO adapter can treat null bytes in a query as a string terminator, allowing an attacker to add arbitrary SQL following a null byte, and thus create a SQL injection. This only impacts MsSql and SQLite adapters.","references":[{"reference_url":"http://framework.zend.com/security/advisory/ZF2015-08","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://framework.zend.com/security/advisory/ZF2015-08"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7695","reference_id":"","reference_type":"","scores":[{"value":"0.02248","scoring_system":"epss","scoring_elements":"0.84906","published_at":"2026-06-05T12:55:00Z"},{"value":"0.02248","scoring_system":"epss","scoring_elements":"0.84884","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-7695"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5723"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695"},{"reference_url":"https://github.com/zendframework/zf1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/zendframework/zf1"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7695","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7695"},{"reference_url":"http://www.debian.org/security/2015/dsa-3369","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2015/dsa-3369"},{"reference_url":"http://www.openwall.com/lists/oss-security/2015/09/30/6","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2015/09/30/6"},{"reference_url":"http://www.openwall.com/lists/oss-security/2015/09/30/8","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2015/09/30/8"},{"reference_url":"http://www.openwall.com/lists/oss-security/2015/10/11/3","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2015/10/11/3"},{"reference_url":"http://www.securityfocus.com/bid/76784","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/76784"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52374?format=json","purl":"pkg:composer/zendframework/zendframework1@1.12.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2xx4-77e9-pfbb"},{"vulnerability":"VCID-8atm-865q-mkf3"},{"vulnerability":"VCID-b1da-n1u7-43hj"},{"vulnerability":"VCID-bjvu-jg9w-mqdd"},{"vulnerability":"VCID-c8kp-n8m3-2khe"},{"vulnerability":"VCID-h5yf-ahec-gbgx"},{"vulnerability":"VCID-n2gy-93nd-gber"},{"vulnerability":"VCID-q73m-16a9-rkgx"},{"vulnerability":"VCID-rc3w-5r97-k3b3"},{"vulnerability":"VCID-sjw9-2fwe-5ybg"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.16"}],"aliases":["CVE-2015-7695","GHSA-2hvh-c5c2-vj85"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uvgx-4m6v-2bg7"}],"fixing_vulnerabilities":[],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zendframework1@1.12.15"}