PHP

CVEs (731)

• CVE-2007-1380Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer…

• CVE-2007-1376Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate…

• CVE-2007-1375Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value in the length argument, a different vulnerability than CVE-2006-1991.

• CVE-2007-1359Mar 8, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still…

• CVE-2007-0908Feb 13, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with…

• CVE-2006-4812Oct 10, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.15

  Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function…

• CVE-2006-0996Apr 10, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.

• CVE-2006-1015Mar 7, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and…

• CVE-2006-0097Jan 6, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the…

• CVE-2004-1018Jan 10, 2005
  PHP

  PHP
  risk 0.04cvss —epss 0.16

  Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or…

• CVE-2004-1020Jan 10, 2005
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the…

• CVE-2004-1392Dec 31, 2004
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

• CVE-2004-0958Nov 3, 2004
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.

• CVE-2003-0863Nov 17, 2003
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file…

• CVE-2003-0442Jul 24, 2003
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter.

• CVE-2003-0166Apr 2, 2003
  PHP

  PHP
  risk 0.04cvss —epss 0.14

  Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other…

• CVE-2002-1954Dec 31, 2002
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.

• CVE-2002-0484Aug 12, 2002
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.

• CVE-2002-0229May 16, 2002
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.

• CVE-2001-1246Jun 30, 2001
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.