PHP

CVEs (751)

• CVE-2007-1521Mar 20, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

• CVE-2007-1522Mar 20, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via illegal characters in a session identifier, which is rejected by an internal session storage module, which calls the session identifier…

• CVE-2007-1453Mar 14, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filter_var with certain modes such as FILTER_VALIDATE_INT, which causes filter to write a null byte…

• CVE-2007-1413Mar 12, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id).

• CVE-2007-1411Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the (1) mssql_connect and (2) mssql_pconnect functions.

• CVE-2007-1381Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code…

• CVE-2007-1380Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer…

• CVE-2007-1375Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value in the length argument, a different vulnerability than CVE-2006-1991.

• CVE-2007-1376Mar 10, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate…

• CVE-2007-1359Mar 8, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still…

• CVE-2007-0908Feb 13, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with…

• CVE-2006-4812Oct 10, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.15

  Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function…

• CVE-2006-0996Apr 10, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.

• CVE-2006-1015Mar 7, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and…

• CVE-2006-0097Jan 6, 2006
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the…

• CVE-2004-1018Jan 10, 2005
  PHP

  PHP
  risk 0.04cvss —epss 0.16

  Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or…

• CVE-2004-1020Jan 10, 2005
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the…

• CVE-2004-1392Dec 31, 2004
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

• CVE-2004-0958Nov 3, 2004
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.

• CVE-2003-0863Nov 17, 2003
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file…