Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2024-2756

__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

CVSS 3.1 · 6.5 Medium EPSS 38.1% KEV · Not listed
Vendors
Php Redhat
Products
Archive Tar Enterprise Linux
CVE-2020-28949

Archive_Tar: improper filename sanitization leads to file overwrites

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

CVSS 3.1 · 7.8 High EPSS 84.6% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 2 more
Products
Debian Linux Drupal Fedora and 3 more
CVE-2020-36193

Archive_Tar: directory traversal due to inadequate checking of symbolic links

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CVSS 3.1 · 7.5 High EPSS 70.6% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 2 more
Products
Debian Linux Drupal Fedora and 3 more
CVE-2021-32610

php-pear: Directory traversal vulnerability

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

CVSS 3.1 · 7.1 High EPSS 73.4% KEV · Not listed
Vendors
Debian Fedoraproject Php and 1 more
Products
Debian Linux Fedora Archive Tar and 1 more
CVE-2020-28948

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVSS 3.1 · 7.8 High EPSS 47.5% KEV · Not listed
Vendors
Debian Drupal Fedoraproject and 2 more
Products
Debian Linux Drupal Fedora and 3 more