zendframework/zendframework1 (Packagist)
Advisories
49
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.12.20 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require zendframework/zendframework1:^1.12.20Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions |
Critical | < 1.12.20 | 1.12.20 |
| GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability |
High | >= 1.12.0, < 1.12.17 | 1.12.17 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability |
High | >= 1.12.0, < 1.12.18 | 1.12.18 |
| GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) |
Critical | >= 1.12.0, < 1.12.16 | 1.12.16 |
| GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select |
Critical | >= 1.12.0, < 1.12.7 | 1.12.7 |
| GHSA-9v78-h226-2rmq Zendframework potential security issue in login mechanism |
High | >= 1.12.0, < 1.12.4 | 1.12.4 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed |
Medium | >= 1.9.0, < 1.9.7 | 1.9.7 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed |
Medium | >= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed |
Medium | >= 1.7.0, < 1.7.9 | 1.7.9 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` |
Medium | >= 1.9.0, < 1.9.7 | 1.9.7 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` |
Medium | >= 1.7.0, < 1.7.9 | 1.7.9 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` |
Medium | >= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-vvm3-rv48-j3g5 Zendframework Potential XSS or HTML Injection vector in Zend_Json |
Medium | >= 1.9.0, < 1.9.7 | 1.9.7 |
| GHSA-vvm3-rv48-j3g5 Zendframework Potential XSS or HTML Injection vector in Zend_Json |
Medium | >= 1.7.0, < 1.7.9 | 1.7.9 |
| GHSA-vvm3-rv48-j3g5 Zendframework Potential XSS or HTML Injection vector in Zend_Json |
Medium | >= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-w5mj-j45q-m638 ZendFramework1 Potential Security Issues in Bundled Dojo Library |
Medium | >= 1.10.0, < 1.10.3 | 1.10.3 |
| GHSA-w5mj-j45q-m638 ZendFramework1 Potential Security Issues in Bundled Dojo Library |
Medium | >= 1.9.0, < 1.9.8 | 1.9.8 |
| GHSA-229x-22xc-2f2w Zendframework Local file disclosure via XXE injection in Zend_XmlRpc |
High | >= 1.0.0, < 1.11.13 | 1.11.13 |
| GHSA-2jx7-xg83-j2m7 Zendframework Denial of Service vector via XEE injection |
High | >= 1.0.0, < 1.11.13 | 1.11.13 |
| GHSA-gwpm-pm6x-h7rj ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags` |
Medium | >= 1.7.0, < 1.7.6 | 1.7.6 |
| GHSA-g52p-86j5-xr8q ZendFramework Potential Cross-site Scripting in Development Environment Error View Script |
Medium | >= 1.0.0, < 1.11.4 | 1.11.4 |
| GHSA-mhpx-3rv8-wrjm ZendFramework potential XML eXternal Entity injection vectors |
Critical | >= 1.12.0, < 1.12.4 | 1.12.4 |
| GHSA-4j9x-g4x8-vcmf ZendFramework potential XML eXternal Entity injection vectors |
High | >= 1.11.0, < 1.11.15 | 1.11.15 |
| GHSA-4j9x-g4x8-vcmf ZendFramework potential XML eXternal Entity injection vectors |
High | >= 1.12.0, < 1.12.1 | 1.12.1 |
| GHSA-hg35-vqp3-fv39 ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings |
Medium | >= 1.9.0, < 1.9.7 | 1.9.7 |
| GHSA-qf36-fx9f-232x ZendFramework potential SQL Injection Vector When Using PDO_MySql |
Critical | >= 1.10.0, < 1.10.9 | 1.10.9 |
| GHSA-qf36-fx9f-232x ZendFramework potential SQL Injection Vector When Using PDO_MySql |
Critical | >= 1.11.0, < 1.11.6 | 1.11.6 |
| GHSA-j543-vg33-g6vj ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` |
Medium | >= 1.7.0, < 1.7.9 | 1.7.9 |
| GHSA-j543-vg33-g6vj ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` |
Medium | >= 1.8.0, < 1.8.5 | 1.8.5 |
| GHSA-j543-vg33-g6vj ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor` |
Medium | >= 1.9.0, < 1.9.7 | 1.9.7 |
| GHSA-hx3m-959f-v849 ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()` |
High | >= 1.7.0, < 1.7.5 | 1.7.5 |
| GHSA-qh9w-r7g5-q939 Zend Framework SQL injection vulnerability |
Critical EPSS 2.55% |
>= 1.12.0, < 1.12.9 | 1.12.9 |
| GHSA-5957-5crx-79jx Zenario CMS vulnerable to CRLF injection |
Medium EPSS 1.01% |
< 1.12.12 | 1.12.12 |
| GHSA-h5p3-7mg6-hgj4 Zend Framework XEE Vulnerability |
Medium EPSS 2.52% |
>= 1.0, < 1.11.13 | 1.11.13 |
| GHSA-h5p3-7mg6-hgj4 Zend Framework XEE Vulnerability |
Medium EPSS 2.52% |
>= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
| GHSA-9m5v-vq4f-mrvf Zend Framework XXE Vulnerability |
Medium EPSS 1.70% |
>= 1.12.0-rc1, < 1.12.1 | 1.12.1 |
| GHSA-9m5v-vq4f-mrvf Zend Framework XXE Vulnerability |
Medium EPSS 1.70% |
< 1.11.15 | 1.11.15 |
| GHSA-jh4x-4wmf-67pr Zend Framework XEE Vulnerability |
Medium EPSS 1.85% |
>= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
| GHSA-jh4x-4wmf-67pr Zend Framework XEE Vulnerability |
Medium EPSS 1.85% |
>= 1.0, < 1.11.13 | 1.11.13 |
| GHSA-7pg4-5233-82jv Zend Framework XXE Vulnerability |
High EPSS 49.31% |
>= 1.12.0-rc1, < 1.12.0 | 1.12.0 |
| GHSA-7pg4-5233-82jv Zend Framework XXE Vulnerability |
High EPSS 49.31% |
>= 1.0.0, < 1.11.12 | 1.11.12 |
| GHSA-pw5c-xqf2-6xc2 Doctrine Security Misconfiguration Vulnerability |
High EPSS 0.38% |
>= 1.12.0, < 1.12.16 | 1.12.16 |
| GHSA-2hvh-c5c2-vj85 Zend Framework SQL injection vector using null byte for PDO |
Critical EPSS 2.89% |
< 1.12.16 | 1.12.16 |
| GHSA-xp8p-9rq5-4wgv ZendXml and Zend Framework contain XXE and XEE Vulnerabilities |
Medium EPSS 9.87% |
>= 1.12.0, < 1.12.14 | 1.12.14 |
| GHSA-f6rc-rh43-h8gr Zend Access Restriction Bypass |
Medium EPSS 2.50% |
>= 1.12.0, < 1.12.9 | 1.12.9 |
| GHSA-p9hp-3gpv-52w3 Zend Framework Allows SQL Injection |
Critical EPSS 2.05% |
< 1.12.19 | 1.12.19 |
| GHSA-gp39-h9c2-qw79 Several Zend Products Vulnerable to XXE and XEE attacks |
Medium EPSS 2.18% |
< 1.12.4 | 1.12.4 |
| GHSA-5wm2-38q5-5rxv Several Zend Products Vulnerable to XXE and XEE attacks |
Medium EPSS 2.35% |
< 1.12.4 | 1.12.4 |
| GHSA-43xg-87xw-jpv8 Several Zend Products Vulnerable to XXE and XEE attacks |
Medium EPSS 2.59% |
< 1.12.4 | 1.12.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor