p PatchFirst

PatchFirst · Latest vulnerabilities

zendframework/zendframework vulnerabilities · Page 2

Vulnerabilities published for zendframework/zendframework in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 23

  1. CVE-2015-5723

    High · CVSS 7.8EPSS 0.38%Fix available

    CVE-2015-5723

    Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

    zendframework/zendframeworkPHP
    • Update to 2.4.8
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2015-5161

    Not ratedEPSS 9.87%Public exploitFix available

    CVE-2015-5161

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

    zendframework/zendframework zendframework/zendframework zendframework/zendframeworkPHP
    • Update to 1.12.14
    • Update to 2.4.6
    • Update to 2.5.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2014-8088

    Not ratedEPSS 2.5%Fix available

    CVE-2014-8088

    The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind.

    zendframework/zendframework zendframework/zendframework zendframework/zendframework zendframework/zendframeworkPHP
    • Update to 2.0.99
    • Update to 2.1.99
    • Update to 2.2.8
    • Update to 2.3.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →