CVE-2014-2683

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.

• CWE-17

• http://advisories.mageia.org/MGASA-2014-0151.htmlThird Party Advisory
• http://framework.zend.com/security/advisory/ZF2014-01Vendor Advisory
• http://seclists.org/oss-sec/2014/q2/0Mailing List, Third Party Advisory
• http://www.debian.org/security/2015/dsa-3265Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2014:072Third Party Advisory
• http://www.securityfocus.com/bid/66358Third Party Advisory, VDB Entry
• http://advisories.mageia.org/MGASA-2014-0151.htmlThird Party Advisory
• http://framework.zend.com/security/advisory/ZF2014-01Vendor Advisory
• http://seclists.org/oss-sec/2014/q2/0Mailing List, Third Party Advisory
• http://www.debian.org/security/2015/dsa-3265Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2014:072Third Party Advisory
• http://www.securityfocus.com/bid/66358Third Party Advisory, VDB Entry

Published

Nov 16, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2674Directory traversal vulnerability in the Ajax Pagination (tw…
• CVE-2014-2675Cross-site request forgery (CSRF) vulnerability in inc/Admin…
• CVE-2014-2678The rds_iw_laddr_check function in net/rds/iw.c in the Linux…
• CVE-2014-2680The update process in Xmind 3.4.1 and earlier allow remote a…8.1
• CVE-2014-2681Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 befor…
• CVE-2014-2682Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 befor…
• CVE-2014-2684The GenericConsumer class in the Consumer component in ZendO…
• CVE-2014-2685The GenericConsumer class in the Consumer component in ZendO…
• CVE-2014-2686Ansible prior to 1.5.4 mishandles the evaluation of some str…7.5
• CVE-2014-2689Cross-site scripting (XSS) vulnerability in Offiria 2.1.0 an…
• CVE-2014-2690Citrix VDI-in-a-Box 5.3.x before 5.3.6 and 5.4.x before 5.4.…
• CVE-2014-2706Race condition in the mac80211 subsystem in the Linux kernel…