zendframework/zendframework1 vulnerabilities
Zend Framework 1
- Registry
- Composer
- Latest
- 1.12.20
- License
- BSD-3-Clause
34 known advisories
The latest version, 1.12.20, is not affected by any of them. Projects on older versions may be.
composer require zendframework/zendframework1:^1.12.20Security advisories for zendframework/zendframework1
Zendframework1 Potential SQL injection in ORDER and GROUP functions
- Affected
- <1.12.20
- Fixed in
- 1.12.20
Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
- Affected
- >=1.12.0 <1.12.17
- Fixed in
- 1.12.17
ZendFramework1 Potential Insufficient Entropy Vulnerability
- Affected
- >=1.12.0 <1.12.18
- Fixed in
- 1.12.18
Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite)
- Affected
- >=1.12.0 <1.12.16
- Fixed in
- 1.12.16
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
- Affected
- >=1.12.0 <1.12.7
- Fixed in
- 1.12.7
Zendframework potential security issue in login mechanism
- Affected
- >=1.12.0 <1.12.4
- Fixed in
- 1.12.4
Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed
- Affected
- >=1.7.0 <1.7.9 · >=1.8.0 <1.8.5 · >=1.9.0 <1.9.7
- Fixed in
- 1.7.9, 1.8.5, 1.9.7
Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`
- Affected
- >=1.7.0 <1.7.9 · >=1.8.0 <1.8.5 · >=1.9.0 <1.9.7
- Fixed in
- 1.7.9, 1.8.5, 1.9.7
Zendframework Potential XSS or HTML Injection vector in Zend_Json
- Affected
- >=1.7.0 <1.7.9 · >=1.8.0 <1.8.5 · >=1.9.0 <1.9.7
- Fixed in
- 1.7.9, 1.8.5, 1.9.7
ZendFramework1 Potential Security Issues in Bundled Dojo Library
- Affected
- >=1.9.0 <1.9.8 · >=1.10.0 <1.10.3
- Fixed in
- 1.9.8, 1.10.3
Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
- Affected
- >=1.0.0 <1.11.13
- Fixed in
- 1.11.13
Zendframework Denial of Service vector via XEE injection
- Affected
- >=1.0.0 <1.11.13
- Fixed in
- 1.11.13
ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`
- Affected
- >=1.7.0 <1.7.6
- Fixed in
- 1.7.6
ZendFramework Potential Cross-site Scripting in Development Environment Error View Script
- Affected
- >=1.0.0 <1.11.4
- Fixed in
- 1.11.4
ZendFramework potential XML eXternal Entity injection vectors
- Affected
- >=1.12.0 <1.12.4
- Fixed in
- 1.12.4
ZendFramework potential XML eXternal Entity injection vectors
- Affected
- >=1.11.0 <1.11.15 · >=1.12.0 <1.12.1
- Fixed in
- 1.11.15, 1.12.1
ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings
- Affected
- >=1.9.0 <1.9.7
- Fixed in
- 1.9.7
ZendFramework potential SQL Injection Vector When Using PDO_MySql
- Affected
- >=1.10.0 <1.10.9 · >=1.11.0 <1.11.6
- Fixed in
- 1.10.9, 1.11.6
ZendFramework potential Cross-site Scripting vector in `Zend_Dojo_View_Helper_Editor`
- Affected
- >=1.7.0 <1.7.9 · >=1.8.0 <1.8.5 · >=1.9.0 <1.9.7
- Fixed in
- 1.7.9, 1.8.5, 1.9.7
ZendFramework local file inclusion vector in `Zend_View::setScriptPath()` and `render()`
- Affected
- >=1.7.0 <1.7.5
- Fixed in
- 1.7.5
Zend Framework SQL injection vulnerability
- Affected
- >=1.12.0 <1.12.9
- Fixed in
- 1.12.9
Zenario CMS vulnerable to CRLF injection
- Affected
- <1.12.12
- Fixed in
- 1.12.12
Zend Framework XEE Vulnerability
- Affected
- >=1.0 <1.11.13 · >=1.12.0-rc1 <1.12.0
- Fixed in
- 1.11.13, 1.12.0
Zend Framework XXE Vulnerability
- Affected
- <1.11.15 · >=1.12.0-rc1 <1.12.1
- Fixed in
- 1.11.15, 1.12.1
Zend Framework XEE Vulnerability
- Affected
- >=1.0 <1.11.13 · >=1.12.0-rc1 <1.12.0
- Fixed in
- 1.11.13, 1.12.0
Zend Framework XXE Vulnerability
- Affected
- >=1.0.0 <1.11.12 · >=1.12.0-rc1 <1.12.0
- Fixed in
- 1.11.12, 1.12.0
Doctrine Security Misconfiguration Vulnerability
- Affected
- >=1.12.0 <1.12.16
- Fixed in
- 1.12.16
Zend Framework SQL injection vector using null byte for PDO
- Affected
- <1.12.16
- Fixed in
- 1.12.16
ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
- Affected
- >=1.12.0 <1.12.14
- Fixed in
- 1.12.14
Zend Access Restriction Bypass
- Affected
- >=1.12.0 <1.12.9
- Fixed in
- 1.12.9
Zend Framework Allows SQL Injection
- Affected
- <1.12.19
- Fixed in
- 1.12.19
Several Zend Products Vulnerable to XXE and XEE attacks
- Affected
- <1.12.4
- Fixed in
- 1.12.4
Several Zend Products Vulnerable to XXE and XEE attacks
- Affected
- <1.12.4
- Fixed in
- 1.12.4
Several Zend Products Vulnerable to XXE and XEE attacks
- Affected
- <1.12.4
- Fixed in
- 1.12.4
Which of your client projects still run an old zendframework/zendframework1?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.