Login Request a demo
ZE
Vendor
Zend
21 products with CVEs on record
78
CVEs
0
On KEV
0
New 30D
Products
ZF
Zend Framework
Zend
9.8
27 CVEs0 on KEV0 new
ZE
Zendto
Zend
9.8
6 CVEs0 on KEV0 new
ZE
Zendopenid
Zend
–
5 CVEs0 on KEV0 new
ZP
Zend Platform
Zend
–
4 CVEs0 on KEV0 new
FR
Framework
Zend
9.8
3 CVEs0 on KEV0 new
ZE
Zendrest
Zend
–
3 CVEs0 on KEV0 new
ZA
Zendservice Amazon
Zend
–
3 CVEs0 on KEV0 new
ZA
Zendservice Api
Zend
–
3 CVEs0 on KEV0 new
ZA
Zendservice Audioscrobbler
Zend
–
3 CVEs0 on KEV0 new
ZN
Zendservice Nirvanix
Zend
–
3 CVEs0 on KEV0 new
ZS
Zendservice Slideshare
Zend
–
3 CVEs0 on KEV0 new
ZT
Zendservice Technorati
Zend
–
3 CVEs0 on KEV0 new
ZW
Zendservice Windowsazure
Zend
–
3 CVEs0 on KEV0 new
ZS
Zend Server
Zend
6.1
2 CVEs0 on KEV0 new
DI
Diactoros
Zend
6.1
1 CVEs0 on KEV0 new
SE
Server
Zend
–
1 CVEs0 on KEV0 new
ZE
Zend-cache
Zend
7.8
1 CVEs0 on KEV0 new
ZF
Zend Framework Preview
Zend
–
1 CVEs0 on KEV0 new
ZG
Zend Google Data Client Library Preview
Zend
–
1 CVEs0 on KEV0 new
ZE
Zend-mail
Zend
9.8
1 CVEs0 on KEV0 new
ZF
Zf-apigility-doctrine
Zend
7.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2020-29312
ZF
Zend Framework
Zend
9.8
1%
Apr 4An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function
CVE-2021-27888
ZE
Zendto
Zend
6.1
1%
Mar 2ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters
CVE-2021-3007
ZF
Zend Framework
Zend
9.8
75%
Jan 4Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable,…
CVE-2020-8986
ZE
Zendto
Zend
9.8
2%
Mar 24lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with…
CVE-2020-8985
ZE
Zendto
Zend
8.8
1%
Mar 24ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality
CVE-2020-8984
ZE
Zendto
Zend
7.5
0%
Mar 24lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header
CVE-2014-8089
ZF
Zend Framework
Zend
9.8
3%
Feb 17SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute…
CVE-2015-3154
ZF
Zend Framework
Zend
6.1
1%
Jan 27CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP…
CVE-2012-4451
ZF
Zend Framework
Zend
6.1
1%
Jan 3Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1)…
CVE-2014-4913
ZF
Zend Framework
Zend
6.1
1%
Dec 15ZF2014-03 has a potential cross site scripting vector in multiple view helpers
CVE-2011-1939
ZF
Zend Framework
Zend
9.8
4%
Nov 26SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6
CVE-2015-0270
FR
Framework
Zend
9.8
1%
Oct 25Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter
CVE-2018-1000841
ZE
Zendto
Zend
6.1
1%
Dec 20Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code…
CVE-2018-10230
ZS
Zend Server
Zend
6.1
3%
Apr 19Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455
CVE-2014-4914
ZF
Zend Framework
Zend
9.8
2%
Dec 29The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via…
CVE-2015-7503
ZF
Zend Framework
Zend
7.5
1%
Oct 10Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key
CVE-2015-3257
DI
Diactoros
Zend
6.1
1%
Aug 25Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open…
CVE-2015-1555
ZF
Zend Framework
Zend
9.1
1%
Aug 7Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators
CVE-2015-1786
ZF
Zend Framework
Zend
8.8
1%
Jun 8Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers
CVE-2016-6233
ZF
Zend Framework
Zend
9.8
2%
Feb 17The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use…
CVE-2016-4861
ZF
Zend Framework
Zend
9.8
4%
Feb 17The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to…
CVE-2016-10034
ZF
Zend Framework
Zend
9.8
38%
Dec 30The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote…
CVE-2015-7695
ZF
Zend Framework
Zend
9.8
3%
Jun 7The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query
CVE-2015-5723
ZE
Zend-cache
Zend
7.8
0%
Jun 7Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM…
CVE-2015-5161
ZF
Zend Framework
Zend
–
10%
Aug 25The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded…
CVE-2014-2684
ZF
Zend Framework
Zend
–
2%
Nov 16The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the…
CVE-2014-2683
ZN
Zendservice Nirvanix
Zend
–
2%
Nov 16Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,…
CVE-2014-2682
ZE
Zendopenid
Zend
–
2%
Nov 16Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,…
CVE-2014-2681
ZE
Zendopenid
Zend
–
3%
Nov 16Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix,…
CVE-2014-8088
ZF
Zend Framework
Zend
–
2%
Oct 22The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a…
CVE-2014-2685
ZF
Zend Framework
Zend
–
3%
Sep 4The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol…
CVE-2013-6808
ZE
Zendto
Zend
–
1%
Dec 28Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr…
CVE-2012-5657
ZF
Zend Framework
Zend
–
2%
May 2The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files,…
CVE-2012-6532
ZF
Zend Framework
Zend
–
2%
Feb 13(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service…
CVE-2012-6531
ZF
Zend Framework
Zend
–
3%
Feb 13(1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote…
CVE-2012-3363
ZF
Zend Framework
Zend
9.1
49%
Feb 13Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files…
CVE-2012-5382
ZS
Zend Server
Zend
–
1%
Oct 11Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might allow local users to gain…
CVE-2011-3825
SE
Server
Zend
–
1%
Sep 24Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in…
CVE-2009-4417
FR
Framework
Zend
–
1%
Dec 24The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via…
CVE-2007-1370
ZP
Zend Platform
Zend
–
0%
Mar 9Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges by modifying the files
CVE-2007-1369
ZP
Zend Platform
Zend
–
1%
Mar 9ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of php.ini file using the -f parameter, and…
CVE-2006-5900
ZF
Zend Framework Preview
Zend
–
1%
Nov 15Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject…
CVE-2006-5717
ZG
Zend Google Data Client Library Preview
Zend
–
1%
Nov 4Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via…
CVE-2006-4432
ZP
Zend Platform
Zend
–
2%
Aug 29Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a
CVE-2006-4431
ZP
Zend Platform
Zend
–
5%
Aug 29Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of…