Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2015-4603

php: exception:: getTraceAsString type confusion issue after unserialize

The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4602

php: Incomplete Class unserialization type confusion

The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4601

php: type confusion issue in unserialize() with various SOAP methods

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.

CVSS 3.0 · 9.8 Critical EPSS 7.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4600

php: type confusion issue in unserialize() with various SOAP methods

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4599

php: type confusion issue in unserialize() with various SOAP methods

The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4598

php: missing null byte checks for paths in DOM and GD extensions

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.

CVSS 3.0 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4148

php: SoapClient's do_soap_call() type confusion after unserialize()

The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.

CVSS 2.0 · 5.0 Medium EPSS 19.8% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4147

php: SoapClient's __call() type confusion through unserialize()

The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.

CVSS 2.0 · 7.5 High EPSS 12.2% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4142

hostapd: integer underflow in AP mode WMM Action frame processing

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Opensuse Redhat W1.fi
Products
Opensuse Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2015-4026

php: pcntl_exec() accepts paths with NUL character

The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 18.8% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4025

php: regressions in 5.4+

PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4024

php: multipart/form-data request parsing CPU usage DoS

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.

CVSS 2.0 · 5.0 Medium EPSS 41.8% KEV · Not listed
Vendors
Apple Hp Oracle and 2 more
Products
Mac Os X System Management Homepage Linux and 10 more
CVE-2015-4022

php: integer overflow leading to heap overflow when reading FTP file listing

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 20.1% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4021

php: memory corruption in phar_parse_tarfile caused by empty entry file name

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

CVSS 2.0 · 5.0 Medium EPSS 20.5% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-3412

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-3411

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-3330

php: pipelined request executed in deinitialized interpreter under httpd 2.4

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

CVSS 2.0 · 6.8 Medium EPSS 13.5% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-3329

php: buffer overflow in phar_set_inode()

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

CVSS 2.0 · 7.5 High EPSS 38.2% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-3307

php: invalid pointer free() in phar_tar_process_metadata()

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

CVSS 2.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-3281

haproxy: information leak in buffer_slow_realign()

The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Haproxy and 3 more
Products
Ubuntu Linux Debian Linux Haproxy and 11 more