VYPR

PHP

by PHP

Source repositories

CVEs (730)

  • CVE-2010-2484Aug 20, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.

  • CVE-2010-3065Aug 20, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

  • CVE-2010-3064Aug 20, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in the php_mysqlnd_auth_write function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument…

  • CVE-2010-3063Aug 20, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to…

  • CVE-2010-3062Aug 20, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the php_mysqlnd_ok_read function; or (2) trigger a heap-based buffer overflow via a…

  • CVE-2010-2225Jun 24, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.

  • CVE-2010-2191Jun 8, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) parse_str, (2) preg_match, (3) unpack, and (4) pack functions; the (5) ZEND_FETCH_RW, (6) ZEND_CONCAT, and (7) ZEND_ASSIGN_CONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain…

  • CVE-2010-2190Jun 8, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the…

  • CVE-2010-2101May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of…

  • CVE-2010-2100May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace…

  • CVE-2010-2097May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function,…

  • CVE-2010-2093May 27, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.

  • CVE-2010-1917May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.

  • CVE-2010-1915May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature,…

  • CVE-2010-1914May 12, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode…

  • CVE-2010-1868May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.03

    The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query, which triggers access of…

  • CVE-2010-1864May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

  • CVE-2010-1862May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

  • CVE-2010-1861May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed…

  • CVE-2010-1860May 7, 2010
    PHP
    PHP
    risk 0.00cvss —epss 0.01

    The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time…

Page 30 of 37