Vulnerabilities > Zend > Medium

DATE CVE VULNERABILITY TITLE RISK
2021-03-02 CVE-2021-27888 Cross-site Scripting vulnerability in Zend Zendto
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
network
zend CWE-79
4.3
2020-03-24 CVE-2020-8985 Cross-Site Request Forgery (CSRF) vulnerability in Zend Zendto
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
network
zend CWE-352
6.8
2020-03-24 CVE-2020-8984 Origin Validation Error vulnerability in Zend Zendto
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
network
low complexity
zend CWE-346
5.0
2020-01-27 CVE-2015-3154 Injection vulnerability in Zend Framework
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
network
zend CWE-74
4.3
2020-01-03 CVE-2012-4451 Cross-site Scripting vulnerability in multiple products
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
4.3
2019-12-15 CVE-2014-4913 Cross-site Scripting vulnerability in multiple products
ZF2014-03 has a potential cross site scripting vector in multiple view helpers
network
zend debian CWE-79
4.3
2018-12-20 CVE-2018-1000841 Cross-site Scripting vulnerability in Zend Zendto
Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser..
network
zend CWE-79
4.3
2018-04-19 CVE-2018-10230 Cross-site Scripting vulnerability in Zend Server 5.1.0/8.5/9.0
Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.
network
zend CWE-79
4.3
2017-10-10 CVE-2015-7503 Key Management Errors vulnerability in Zend Framework
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
network
low complexity
zend CWE-320
5.0
2017-08-25 CVE-2015-3257 Cross-site Scripting vulnerability in Zend Diactoros
Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks.
network
zend CWE-79
4.3