CVE-2004-1018

security flaw

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

CVSS 2.0 · 10.0 Critical EPSS 16.2% KEV · Not listed

Vendors

Canonical Php Redhat

Products

Ubuntu Linux Php Enterprise Linux and 2 more

CVE-2004-1019

security flaw

The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

CVSS 2.0 · 10.0 Critical EPSS 8.0% KEV · Not listed

Vendors

Openpkg Php Redhat and 2 more

Products

Openpkg Php Enterprise Linux and 4 more

CVE-2005-2700

security flaw

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

CVSS 2.0 · 10.0 Critical EPSS 30.6% KEV · Not listed

Vendors

Apache Canonical Debian and 1 more

Products

Http Server Ubuntu Linux Debian Linux and 3 more

CVE-2005-2933

security flaw

Buffer overflow in the mail_valid_net_parse_work function in mail.c for Washington's IMAP Server (UW-IMAP) before imap-2004g allows remote attackers to execute arbitrary code via a mailbox name containing a single double-quote (") character without a closing quote, which causes bytes after the double-quote to be copied into a buffer indefinitely.

CVSS 2.0 · 7.5 High EPSS 8.5% KEV · Not listed

Vendors

Redhat University Of Washington

Products

Enterprise Linux Rhel Stronghold Uw-imap

CVE-2005-3352

httpd cross-site scripting flaw in mod_imap

Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.

CVSS 2.0 · 4.3 Medium EPSS 73.7% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Network Proxy and 2 more

CVE-2005-3388

security flaw

Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."

CVSS 2.0 · 4.3 Medium EPSS 48.9% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold and 1 more

CVE-2005-3389

security flaw

The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.

CVSS 2.0 · 5.0 Medium EPSS 6.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold and 1 more

CVE-2005-3390

security flaw

The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.

CVSS 2.0 · 7.5 High EPSS 65.5% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold and 1 more

CVE-2006-0208

security flaw

Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.

CVSS 2.0 · 2.6 Low EPSS 3.8% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2006-0996

security flaw

Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.

CVSS 2.0 · 4.3 Medium EPSS 11.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2002-0392

security flaw

Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.

CVSS 2.0 · 7.5 High EPSS 95.2% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Http Server Debian Linux Enterprise Linux and 4 more

CVE-2006-1990

security flaw

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.

CVSS 2.0 · 5.0 Medium EPSS 10.6% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2006-3016

security flaw

Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().

CVSS 2.0 · 9.3 Critical EPSS 2.5% KEV · Not listed

Vendors

Php Group Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2006-3017

security flaw

zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.

CVSS 2.0 · 9.3 Critical EPSS 4.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2006-3918

httpd: Expect header XSS

http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.

CVSS 2.0 · 4.3 Medium EPSS 95.1% KEV · Not listed

Vendors

Apache Canonical Debian and 1 more

Products

Http Server Ubuntu Linux Debian Linux and 6 more

CVE-2006-4020

security flaw

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

CVSS 2.0 · 4.6 Medium EPSS 2.0% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Application Stack and 1 more

CVE-2006-1494

security flaw

Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.

CVSS 2.0 · 2.6 Low EPSS 6.4% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Stronghold

CVE-2002-0653

security flaw

Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Modssl Redhat

Products

Mod Ssl Enterprise Linux Linux and 3 more

CVE-2002-0839

security flaw

The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Http Server Debian Linux Enterprise Linux and 3 more

CVE-2002-0840

security flaw

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

CVSS 2.0 · 6.8 Medium EPSS 95.1% KEV · Not listed

Vendors

Apache Oracle Redhat

Products

Http Server Application Server Database Server and 6 more