Zend vulnerabilities, page 3
48 vulnerabilities
Known vulnerabilities in Zend products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
CVE-2011-1939debiandebian_linux+4
EPSS score3.86%
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.CVE-2011-3825ubuntuzend-framework+2EPSS score1.46%
Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.CVE-2024-9129zendzend_serverEPSS score0.43%
In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered.
Reported by Dylan MarinoCVE-2009-4417zendframeworkEPSS score0.86%
The shutdown function in the Zend_Log_Writer_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail messages to any recipient address via vectors related to "events not yet mailed."CVE-2006-4431zendzend_platformEPSS score4.62%
Multiple buffer overflows in the (a) Session Clustering Daemon and the (b) mod_cluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a (1) empty or (2) crafted PHP session identifier (PHPSESSID).CVE-2006-4432zendzend_platformEPSS score2.09%
Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the final component of the PHP session identifier (PHPSESSID). NOTE: in some cases, this issue can be leveraged to perform direct static code injection.CVE-2006-5717zendzend_google_data_client_library_previewEPSS score1.16%
Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) basedemo.php and (2) calenderdemo.php in samples/, and other unspecified files.CVE-2006-5900zendzend_framework_previewEPSS score1.27%
Cross-site scripting (XSS) vulnerability in the incubator/tests/Zend/Http/_files/testRedirections.php sample code in Zend Framework Preview 0.2.0 allows remote attackers to inject arbitrary web script or HTML via arbitrary parameters.