This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Zend First view 2014-11-15
Product Zend Framework Last view 2020-02-17
Version 1.12.9 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:zend:zend_framework

Activity : Overall

Related : CVE

  Date Alert Description
9.8 2020-02-17 CVE-2014-8089

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

6.1 2020-01-27 CVE-2015-3154

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

6.1 2020-01-03 CVE-2012-4451

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.

6.1 2019-12-15 CVE-2014-4913

ZF2014-03 has a potential cross site scripting vector in multiple view helpers

9.8 2017-02-16 CVE-2016-6233

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern [\w]* in a regular expression.

9.8 2017-02-16 CVE-2016-4861

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

9.8 2016-12-30 CVE-2016-10034

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.

9.8 2016-06-07 CVE-2015-7695

The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

7.8 2016-06-07 CVE-2015-5723

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

6.8 2015-08-25 CVE-2015-5161

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

5 2014-11-15 CVE-2014-2683

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.

6.8 2014-11-15 CVE-2014-2682

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.

6.4 2014-11-15 CVE-2014-2681

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.

CWE : Common Weakness Enumeration

%idName
33% (4) CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('...
16% (2) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
16% (2) CWE-19 Data Handling
8% (1) CWE-264 Permissions, Privileges, and Access Controls
8% (1) CWE-77 Improper Sanitization of Special Elements used in a Command ('Comma...
8% (1) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')
8% (1) CWE-17 Code

Snort® IPS/IDS

Date Description
2018-04-12 PHPMailer command injection remote code execution attempt
RuleID : 45917 - Type : SERVER-WEBAPP - Revision : 1
2017-04-06 PHPMailer command injection remote code execution attempt
RuleID : 41813 - Type : SERVER-WEBAPP - Revision : 3
2017-02-01 PHPMailer command injection remote code execution attempt
RuleID : 41106 - Type : SERVER-WEBAPP - Revision : 5
2016-03-14 Zend Technologies Zend Framework heuristicScan XML external entity injection ...
RuleID : 36895 - Type : SERVER-WEBAPP - Revision : 2
2016-03-14 Zend Technologies Zend Framework heuristicScan XML external entity injection ...
RuleID : 36894 - Type : SERVER-WEBAPP - Revision : 2

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2018-06-29 Name: The remote Debian host is missing a security update.
File: debian_DLA-1403.nasl - Type: ACT_GATHER_INFO
2018-04-10 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201804-10.nasl - Type: ACT_GATHER_INFO
2016-11-21 Name: The remote Amazon Linux AMI host is missing a security update.
File: ala_ALAS-2016-767.nasl - Type: ACT_GATHER_INFO
2016-11-15 Name: The remote Fedora host is missing a security update.
File: fedora_2016-666d95d1d5.nasl - Type: ACT_GATHER_INFO
2016-10-10 Name: The remote Fedora host is missing a security update.
File: fedora_2016-7f193a0c59.nasl - Type: ACT_GATHER_INFO
2016-10-10 Name: The remote Fedora host is missing a security update.
File: fedora_2016-77e5105570.nasl - Type: ACT_GATHER_INFO
2016-10-06 Name: The remote Debian host is missing a security update.
File: debian_DLA-646.nasl - Type: ACT_GATHER_INFO
2016-08-29 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2016-1638-1.nasl - Type: ACT_GATHER_INFO
2016-08-02 Name: The remote Fedora host is missing a security update.
File: fedora_2016-fa7e683c6e.nasl - Type: ACT_GATHER_INFO
2016-08-02 Name: The remote Fedora host is missing a security update.
File: fedora_2016-8dc0af2c29.nasl - Type: ACT_GATHER_INFO
2016-07-20 Name: The remote Fedora host is missing a security update.
File: fedora_2016-f0c8b7b115.nasl - Type: ACT_GATHER_INFO
2016-07-20 Name: The remote Fedora host is missing a security update.
File: fedora_2016-7e229134f9.nasl - Type: ACT_GATHER_INFO
2016-06-01 Name: The remote Debian host is missing a security update.
File: debian_DLA-499.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote Fedora host is missing a security update.
File: fedora_2015-f1e18131bc.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote Fedora host is missing a security update.
File: fedora_2015-6d70a701bf.nasl - Type: ACT_GATHER_INFO
2016-03-04 Name: The remote Fedora host is missing a security update.
File: fedora_2015-2e7c06c639.nasl - Type: ACT_GATHER_INFO
2015-10-16 Name: The remote Debian host is missing a security update.
File: debian_DLA-326.nasl - Type: ACT_GATHER_INFO
2015-10-07 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_d3324fdb6bf011e5bc5e00505699053e.nasl - Type: ACT_GATHER_INFO
2015-10-07 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-3369.nasl - Type: ACT_GATHER_INFO
2015-09-21 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15205.nasl - Type: ACT_GATHER_INFO
2015-09-21 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15202.nasl - Type: ACT_GATHER_INFO
2015-09-21 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15200.nasl - Type: ACT_GATHER_INFO
2015-09-15 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15199.nasl - Type: ACT_GATHER_INFO
2015-09-15 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15206.nasl - Type: ACT_GATHER_INFO
2015-09-15 Name: The remote Fedora host is missing a security update.
File: fedora_2015-15204.nasl - Type: ACT_GATHER_INFO