Published: 27/01/2020 Updated: 30/01/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework prior to 1.12.12, 2.x prior to 2.3.8, and 2.4.x prior to 2.4.1 allows remote malicious users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zend zend framework

Debian Bug report logs - #754201 Potential SQL injection in the ORDER implementation of Zend_Db_Select (ZF2014-04) Package: zendframework; Maintainer for zendframework is Debian PHP PEAR Maintainers <pkg-php-pear@listsaliothdebianorg>; Source for zendframework is src:zendframework (PTS, buildd, popcon) Reported by: David ...

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework Except for CVE-2015-3154, all these issues were already fixed in the version initially shipped with Jessie CVE-2014-2681 Lukas Reschke reported a lack of protection against XML External Entity injection attacks in some functions This fix extends the incomple ...

Upstream <a href="frameworkzendcom/security/advisory/ZF2015-04">reported</a> a vulnerability in the Zend\Mail component in Zend Framework 2, specifically in how it handles headers Headers are not correctly filtered for newlines, allowing the ability to send additional, unrelated headers and to bypass additional headers by emit ...

CWE-74 http://framework.zend.com/security/advisory/ZF2015-04 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754201 https://www.debian.org/security/./dsa-3265

CVE-2015-3154

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect