Vulnerabilities > Zend

DATE CVE VULNERABILITY TITLE RISK
2021-01-04 CVE-2021-3007 Deserialization of Untrusted Data vulnerability in multiple products
** DISPUTED ** Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php.
network
low complexity
getlaminas zend CWE-502
7.5
2020-03-24 CVE-2020-8986 Improper Check FOR Unusual OR Exceptional Conditions vulnerability in Zend Zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
network
low complexity
zend CWE-754
7.5
2020-03-24 CVE-2020-8985 Cross-Site Request Forgery (CSRF) vulnerability in Zend Zendto
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
network
zend CWE-352
6.8
2020-03-24 CVE-2020-8984 Origin Validation Error vulnerability in Zend Zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
network
low complexity
zend CWE-346
5.0
2020-02-17 CVE-2014-8089 SQL Injection vulnerability in multiple products
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
network
low complexity
zend redhat fedoraproject CWE-89
7.5
2020-01-27 CVE-2015-3154 Injection vulnerability in Zend Framework
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
network
zend CWE-74
4.3
2020-01-03 CVE-2012-4451 Cross-Site Scripting vulnerability in multiple products
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
4.3
2019-12-15 CVE-2014-4913 Cross-Site Scripting vulnerability in multiple products
ZF2014-03 has a potential cross site scripting vector in multiple view helpers
network
zend debian CWE-79
4.3
2019-11-26 CVE-2011-1939 SQL Injection vulnerability in multiple products
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
network
low complexity
zend php debian CWE-89
7.5
2019-10-25 CVE-2015-0270 SQL Injection vulnerability in Zend Framework
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
network
low complexity
zend CWE-89
7.5