Browse CVEs

CRITICAL 9.8 CVE-2020-8986 lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to g… Zendto Mitigation only Fix from $2,3002020-03-24 HIGH 8.8 CVE-2020-8985 ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality. Zendto Mitigation only Fix from $1,9502020-03-24 HIGH 7.5 CVE-2020-8984 lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header. Zendto Mitigation only Fix from $1,9502020-03-24 HIGH 7.5 CVE-2015-7503 Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private … Zend Framework Mitigation only Fix from $1,9502017-10-10 CRITICAL 9.1 CVE-2015-1555 Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using s… Zend Framework Mitigation only Fix from $2,3002017-08-07 HIGH 8.8 CVE-2015-1786 Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. Zend Framework Mitigation only Fix from $1,9502017-06-08 MEDIUM 6.8 CVE-2015-5161EPSS 10% The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under P… Zend Framework No fix yet Fix from $1,6002015-08-25 MEDIUM 5.0 CVE-2012-5657 The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attac… Zend Framework Mitigation only Fix from $1,6002013-05-02 MEDIUM 6.4 CVE-2012-6531 (1) Zend_Dom, (2) Zend_Feed, and (3) Zend_Soap in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement … Zend Framework Mitigation only Fix from $1,6002013-02-13 MEDIUM 5.0 CVE-2012-6532 (1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers … Zend Framework Mitigation only Fix from $1,6002013-02-13 MEDIUM 6.0 CVE-2012-5382 Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might … Zend Server No fix yet Fix from $1,6002012-10-11 MEDIUM 5.0 CVE-2011-3825 Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reve… Framework Mitigation only Fix from $1,6002011-09-24 MEDIUM 6.8 CVE-2006-5900 Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 all… Zend Framework Preview Mitigation only Fix from $1,6002006-11-15