CVE-2012-4451

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Zend Technologies	Zend Framework	2.0.x before 2.0.1

References

http://framework.zend.com/security/advisory/ZF2012-03Vendor Advisory
http://seclists.org/oss-sec/2012/q3/571Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2012/q3/573Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/55636Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10Mailing List, Third Party Advisory
https://bugs.gentoo.org/show_bug.cgi?id=436210Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=860738Issue Tracking, Patch, Third Party Advisory
https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733Patch, Third Party Advisory
http://framework.zend.com/security/advisory/ZF2012-03Vendor Advisory
http://seclists.org/oss-sec/2012/q3/571Mailing List, Patch, Third Party Advisory
http://seclists.org/oss-sec/2012/q3/573Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/55636Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10Mailing List, Third Party Advisory
https://bugs.gentoo.org/show_bug.cgi?id=436210Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=860738Issue Tracking, Patch, Third Party Advisory
https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733Patch, Third Party Advisory

Timeline

Published: Jan 3, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-44522.1MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a CVE-2012-44532.1dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with wor CVE-2012-44542.9openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a sym CVE-2012-44556.2openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..op CVE-2012-44567.5The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validat CVE-2012-44574.0OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, whic CVE-2012-44585.0The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server cr CVE-2012-44595.0Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a de CVE-2012-44605.0The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a CVE-2012-44611.9The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause CVE-2012-44624.3aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of ser CVE-2012-44635.1Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple