ZF
Product
Zend Framework
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 3Medium 3Low 0
Watch
Add Zend Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-29312 | 9.8 | Apr 4 | An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function Affected: through 3.1.3 |
| CVE-2021-3007 | 9.8 | Jan 4 | Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable,… Affected: 3.0.0 |
| CVE-2014-8089 | 9.8 | Feb 17 | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute… Affected: before 1.12.9; 2.2.0 before 2.2.8; 2.3.0 before 2.3.3 |
| CVE-2011-1939 | 9.8 | Nov 26 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6 Affected: 1.10.0 before 1.10.9; 1.11.0 before 1.11.6 |
| CVE-2014-4914 | 9.8 | Dec 29 | The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via… Affected: before 1.12.7 |
| CVE-2016-6233 | 9.8 | Feb 17 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use… Affected: through 1.12.19 |
| CVE-2016-4861 | 9.8 | Feb 17 | The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to… Affected: through 1.12.19 |
| CVE-2016-10034 | 9.8 | Dec 30 | The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote… Affected: through 2.4.10 |
| CVE-2015-7695 | 9.8 | Jun 7 | The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query Affected: through 1.12.15 |
| CVE-2015-1555 | 9.1 | Aug 7 | Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +7 more |
| CVE-2012-3363 | 9.1 | Feb 13 | Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files… Affected: 1.0.0 before 1.11.12; 1.12.0; 1.12.0; 1.12.0; 1.12.0 |
| CVE-2015-1786 | 8.8 | Jun 8 | Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5 |
| CVE-2015-5723 | 7.8 | Jun 7 | Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM… Affected: through 2.4.7; through 1.12.15 |
| CVE-2015-7503 | 7.5 | Oct 10 | Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +5 more |
| CVE-2015-3154 | 6.1 | Jan 27 | CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP… Affected: before 1.12.12; 2.3.0 before 2.3.8; 2.4.0 before 2.4.1 |
| CVE-2012-4451 | 6.1 | Jan 3 | Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1)… Affected: before 2.0.1 |
| CVE-2014-4913 | 6.1 | Dec 15 | ZF2014-03 has a potential cross site scripting vector in multiple view helpers Affected: before 2.2.7; 2.3.0 before 2.3.1 |
| CVE-2015-5161 | – | Aug 25 | The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.1; +34 more |
| CVE-2014-2684 | – | Nov 16 | The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the… Affected: through 1.12.4 |
| CVE-2014-2683 | – | Nov 16 | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,… Affected: before 1.12.4; 2.1.0 before 2.1.6; 2.2.0 before 2.2.6 |
| CVE-2014-2682 | – | Nov 16 | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,… Affected: before 1.12.4; 2.1.0 before 2.1.6; 2.2.0 before 2.2.6 |
| CVE-2014-2681 | – | Nov 16 | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,… Affected: before 1.12.4; 2.1.0 before 2.1.6; 2.2.0 before 2.2.6 |
| CVE-2014-8088 | – | Oct 22 | The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a… Affected: through 1.12.7; 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; +15 more |
| CVE-2014-2685 | – | Sep 4 | The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol… Affected: through 1.12.3; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |
| CVE-2012-5657 | – | May 2 | The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files,… Affected: 1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +9 more |
| CVE-2012-6532 | – | Feb 13 | (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service… Affected: 1.0.4; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.6.0; +34 more |
| CVE-2012-6531 | – | Feb 13 | (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote… Affected: 1.0.4; 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.6.0; +34 more |
Showing 27