Vulnerabilities

TI-2023-13898 CVE-2023-29530 · GHSA-xv3h-4844-9h36

Laminas Diactoros vulnerable to HTTP Multiline Header Termination

MEDIUM 41

Laminas Diactoros provides PSR HTTP Message implementations.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00965 Published 2023-04-24 Fixed in 2.18.1, 2.19.1 +6 CWE-20

TI-2022-13153 CVE-2022-31109 · GHSA-8274-h5jp-97vr

HTTP Host Header Attack Vulnerability in laminas-diactoros

LOW 39

laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00796 Published 2022-08-01 Fixed in 2.11.1 CWE-444

TI-2022-07651 CVE-2022-23598 · GHSA-jq4p-mq33-w375

Reflected XSS vulnerability when rendering error messages in laminas-form

LOW 29

laminas-form is a package for validating and displaying simple and complex forms.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00989 Published 2022-01-28 Fixed in 3.1.1, 3.0.2 +1 CWE-79

TI-2021-02150 CVE-2021-3007 · GHSA-xx8f-qf9f-5fgw

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a…

HIGH 81

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zen…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75313 Published 2021-01-04 Fixed in 2.14.2 CWE-502

Vulnerabilities

Filters

Laminas Diactoros vulnerable to HTTP Multiline Header Termination

HTTP Host Header Attack Vulnerability in laminas-diactoros

Reflected XSS vulnerability when rendering error messages in laminas-form

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a…