Search for packages
| purl | pkg:composer/zendframework/zendframework@2.0.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1nst-5c2p-1yeq
Aliases: ZF2012-03 |
Cross-site Scripting Potential XSS Vectors in Multiple Zend Framework 2 Components. |
Affected by 25 other vulnerabilities. |
|
VCID-1v65-gj35-x7aq
Aliases: ZF2012-04 |
Unintended Proxy or Intermediary ('Confused Deputy') Potential Proxy Injection Vulnerabilities in Multiple Zend Framework 2 Components. |
Affected by 23 other vulnerabilities. |
|
VCID-32vp-nn7p-6ubz
Aliases: CVE-2015-5161 GHSA-xp8p-9rq5-4wgv |
XXE/XEE vulnerability via multibyte payloads There's a flow that allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters. This only apply when running under PHP-FPM in a threaded environment. |
Affected by 9 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-4ktw-ht2w-tuhg
Aliases: GHSA-x2f4-8wxf-w3vf |
ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-5vu7-szck-9qay
Aliases: ZF2016-04 |
Remote code execution in zend-mail via Sendmail adapter A malicious user may be able to inject arbitrary parameters to the system Sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability. |
Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-5vu8-msgg-uqa5
Aliases: GMS-2015-48 |
Potential Information Disclosure and Insufficient Entropy in Zend\Captcha\Word Zend generates a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. The selection is performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This can potentially lead to information disclosure should an attacker be able to brute force the random number generation. |
Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-7p8m-t45q-77fu
Aliases: GHSA-xg9w-r469-m455 |
ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-8qw1-c6ps-87gr
Aliases: GHSA-62f6-h68r-3jpw |
Zendframework session validation vulnerability |
Affected by 11 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-9f4w-2ekz-9qdj
Aliases: CVE-2014-8088 GHSA-f6rc-rh43-h8gr |
Improper Authentication The (1) `Zend_Ldap` class in Zend and (2) `Zend
dap` component in Zend allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 13 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-b65y-s3xq-gbhk
Aliases: GHSA-8q77-cv62-jj38 |
Zendframework has potential Cross-site Scripting vector in multiple view helpers |
Affected by 15 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-bdzr-b716-b3ar
Aliases: ZF2013-01 |
Paramter Injection Route Parameter Injection Via Query String in `Zend\Mvc`. |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-cbcv-76c1-83fd
Aliases: GHSA-fh7r-58q4-6387 |
Zendframework URL Rewrite vulnerability |
Affected by 3 other vulnerabilities. |
|
VCID-ehec-uwtf-ebd6
Aliases: ZF2015-01 |
Session Fixation Session validation vulnerability. |
Affected by 14 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-ern1-u894-4ubj
Aliases: ZF2018-01 |
URL Redirection to Untrusted Site (Open Redirect) URL Rewrite vulnerability. |
Affected by 3 other vulnerabilities. |
|
VCID-gakp-8kf1-byg4
Aliases: ZF2015-09 |
Potential Information Disclosure and Insufficient Entropy vulnerability in `Zend\Captcha\Word`. |
Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-h5nc-aw9v-eud5
Aliases: GHSA-5gmf-3c43-q73v |
ZendFramework vulnerable to Cross-site Scripting |
Affected by 25 other vulnerabilities. |
|
VCID-jc41-1sa8-muh5
Aliases: GHSA-jq87-2wxp-8349 |
ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc` |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-m522-m798-wff9
Aliases: CVE-2014-8089 GHSA-qh9w-r7g5-q939 |
SQL Injection SQL injection vector when manually quoting values for `sqlsrv` extension, using null byte. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 13 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-m9fb-uwg4-k7dj
Aliases: CVE-2015-0270 GHSA-v59p-p692-v382 |
Affected by 14 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
|
VCID-nku2-h93t-rfbg
Aliases: ZF2013-03 |
SQL Injection Potential SQL injection due to execution of platform-specific SQL containing interpolations. |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-pt1n-7yfb-a7d4
Aliases: CVE-2015-5723 GHSA-pw5c-xqf2-6xc2 |
Security Misconfiguration Vulnerability Doctrine uses `mkdir($cacheDirectory )` to create caches directories. if your application runs with a umask of |
Affected by 8 other vulnerabilities. |
|
VCID-qsu7-ngpp-4qb2
Aliases: CVE-2015-3154 GHSA-5957-5crx-79jx |
CRLF Injection Potential CRLF injection attacks in mail and HTTP headers. |
Affected by 14 other vulnerabilities. Affected by 21 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 10 other vulnerabilities. |
|
VCID-rfxg-rjxa-2ya4
Aliases: GHSA-gff2-p6vm-3p8g |
ZendFramework potential remote code execution in zend-mail via Sendmail adapter |
Affected by 2 other vulnerabilities. |
|
VCID-sfyw-aufq-63a6
Aliases: ZF2013-02 |
Potential Information Disclosure and Insufficient Entropy vulnerabilities in `Zend\Math\Rand` and `Zend\Validate\Csrf` Components. |
Affected by 17 other vulnerabilities. Affected by 19 other vulnerabilities. |
|
VCID-skyf-p5pm-7ybp
Aliases: CVE-2015-7503 GHSA-pm9m-w23q-5967 |
Potential Information Disclosure in Zend\Crypt\PublicKey\Rsa\PublicKey Zend\Crypt\PublicKey\Rsa\PublicKey has a call to `openssl_public_encrypt()` which uses PHP's default `$padding` argument, which specifies `OPENSSL_PKCS1_PADDING`, indicating usage of PKCS1v1.5 padding. This padding has a known vulnerability, the Bleichenbacher's chosen-ciphertext attack, which can be used to decrypt arbitrary ciphertexts. Users should upgrade to a fixed version unless there are not using the RSA public key functionality. |
Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-uzrf-qjjv-gkcx
Aliases: ZF2014-03 |
Cross-site Scripting Potential XSS vector in multiple view helpers. |
Affected by 15 other vulnerabilities. Affected by 17 other vulnerabilities. |
|
VCID-wwuh-zdmc-2fff
Aliases: GHSA-mg7h-9qfx-4r83 |
ZendFramework Potential Proxy Injection Vulnerabilities |
Affected by 23 other vulnerabilities. |
|
VCID-xzuu-fk13-2qa1
Aliases: GHSA-2fhr-8r8r-qp56 |
ZendFramework Information Disclosure and Insufficient Entropy vulnerability |
Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-py3s-p8pc-t3em | SQL Injection The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern `[\w]*` in a regular expression. |
CVE-2016-6233
GHSA-p9hp-3gpv-52w3 |