Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2010-1866

php: dechunk filter integer signedness error causing buffer overflow (MOPS-2010-003)

The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed
Vendors
Opensuse Php Suse
Products
Opensuse Php Linux Enterprise
CVE-2014-2020

php: multiple vulnerabilities in gdImageCrop()

ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Php
Products
Php
CVE-2012-3450

php: PDO array over-read crash

pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string during parsing of prepared statements, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted parameter value.

CVSS 2.0 · 2.6 Low EPSS 11.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-1864

php: addcslashes interruption vulnerability (MOPS-2010-006)

The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2013-4248

php: hostname check bypassing vulnerability in SSL client

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 4.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux
CVE-2010-1862

php: chunk_split interruption vulnerability (MOPS-2010-008)

The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2013-4113

php: xml_parse_into_struct buffer overflow when parsing deeply nested XML

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

CVSS 2.0 · 6.8 Medium EPSS 5.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Els and 2 more
CVE-2012-3365

php: open_basedir bypass via SQLite functionality

The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Php
Products
Php
CVE-2012-2688

php: Integer Signedness issues in _php_stream_scandir

Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."

CVSS 2.0 · 10.0 Critical EPSS 10.5% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2012-2386

php: Integer overflow leading to heap-buffer overflow in the Phar extension

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 42.1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2010-1861

php: shm_put_var interruption vulnerability (MOPS-2010-009)

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed resource.

CVSS 2.0 · 6.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-1860

php: html_entity_decode interruption vulnerability (MOPS-2010-010)

The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-1130

php: safe_mode / open_basedir security fixes in 5.2.13/5.3.2

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

CVSS 2.0 · 5.0 Medium EPSS 9.5% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-1129

php: safe_mode / open_basedir security fixes in 5.2.13/5.3.2

The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-1128

php: LCG entropy weakness

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

CVSS 2.0 · 6.4 Medium EPSS 8.1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2010-0397

php: NULL pointer dereference in XML-RPC extension

The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.

CVSS 2.0 · 5.0 Medium EPSS 11.5% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2009-5016

php: XSS and SQL injection bypass via crafted overlong UTF-8 encoded string

Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.

CVSS 2.0 · 6.8 Medium EPSS 2.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2006-7243

php: paths with NULL character were considered valid

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

CVSS 2.0 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2012-2376

php: Buffer overflow in com_print_typeinfo() by parsing certain variant types

Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.

CVSS 2.0 · 10.0 Critical EPSS 19.8% KEV · Not listed
Vendors
Microsoft Php
Products
Windows Php