Vulnerabilities > Zend > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-02-13 | CVE-2012-6532 | Resource Management Errors vulnerability in Zend Framework (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. | 5.0 |
| 2013-02-13 | CVE-2012-6531 | Improper Input Validation vulnerability in Zend Framework (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363. | 6.4 |
| 2011-09-24 | CVE-2011-3825 | Information Exposure vulnerability in Zend Framework and Server Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files. | 5.0 |
| 2009-12-24 | CVE-2009-4417 | Permissions, Privileges, and Access Controls vulnerability in Zend Framework The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed." | 5.0 |
| 2007-03-09 | CVE-2007-1370 | Unspecified vulnerability in Zend Platform 2.2.1A Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files. | 6.2 |
| 2007-03-09 | CVE-2007-1369 | Unspecified vulnerability in Zend Platform ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and then performing a symlink attack using the directory that contains the attacker-controlled php.ini file, and linking this directory to /usr/local/Zend/etc. local zend | 4.4 |
| 2006-11-15 | CVE-2006-5900 | Cross-Site Scripting vulnerability in Zend Framework Preview 0.2.0 Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters. network zend | 6.8 |
| 2006-11-04 | CVE-2006-5717 | Cross-Site Scripting vulnerability in Zend Google Data Client Library Preview 0.2.0 Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) basedemo.php and (2) calenderdemo.php in samples/, and other unspecified files. network zend | 4.3 |