PatchTheCVEzend vulnerabilities
Recent CVEs affecting zend products. 20 tracked.
zend has 20 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 14. Most recent: 2023-04-04. Highest priority: CVE-2011-1939 (score 72/100).
- CVE-2020-29312 CRITICAL 9.8 UPGRADE An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the
- CVE-2021-3007 CRITICAL 9.8 UPGRADE DOWNGRADE Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that
- CVE-2020-8986 CRITICAL 9.8 DOWNGRADE lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the se
- CVE-2020-8985 HIGH 8.8 DOWNGRADE ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
- CVE-2020-8984 HIGH 7.5 DOWNGRADE lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header.
- CVE-2018-10230 MEDIUM 6.1 UPGRADE Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.
- CVE-2018-1000841 MEDIUM 6.1 UPGRADE Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page tha
- CVE-2016-6233 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote
- CVE-2016-4861 CRITICAL 9.8 MITIGATE UPGRADE The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote
- CVE-2016-10034 CRITICAL 9.8 UPGRADE UPGRADE The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x
- CVE-2015-7503 HIGH 7.5 DOWNGRADE Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remot
- CVE-2015-3257 MEDIUM 6.1 UPGRADE Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which all
- CVE-2015-1786 HIGH 8.8 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 vi
- CVE-2015-1555 CRITICAL 9.1 DOWNGRADE Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers t
- CVE-2015-0270 CRITICAL 9.8 UPGRADE Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
- CVE-2014-8089 CRITICAL 9.8 UPGRADE MITIGATE SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when
- CVE-2014-4914 CRITICAL 9.8 UPGRADE MITIGATE The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which
- CVE-2014-4913 MEDIUM 6.1 UPGRADE MITIGATE ZF2014-03 has a potential cross site scripting vector in multiple view helpers
- CVE-2012-4451 MEDIUM 6.1 UPGRADE MITIGATE Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attacker
- CVE-2011-1939 CRITICAL 9.8 UPGRADE UPGRADE SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASC
FAQ
How do I fix zend vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zend being exploited right now?
None of the tracked zend CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zend CVE should I patch first?
CVE-2011-1939 currently ranks highest (72/100): SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASC.