CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

PHP » PHP : Security Vulnerabilities (CVSS score between 6 and 7.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-1999-0058 Overflow 1997-04-17 2008-09-09
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in PHP cgi program, php.cgi allows shell access.
2 CVE-1999-0068 1997-10-19 2008-09-09
7.5
 None Remote Low Not required Partial Partial Partial
CGI PHP mylog script allows an attacker to read any file on the target server.
3 CVE-2001-1246 Exec Code 2001-06-30 2008-09-10
7.5
 None Remote Low Not required Partial Partial Partial
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
4 CVE-2001-1247 264 2001-12-06 2012-06-25
6.4
 None Remote Low Not required Partial Partial None
PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.
5 CVE-2002-0081 Exec Code Overflow 2002-03-08 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.
6 CVE-2002-0229 Bypass 2002-05-16 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements.
7 CVE-2002-0717 DoS Exec Code 2002-07-26 2016-10-18
7.5
 None Remote Low Not required Partial Partial Partial
PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed.
8 CVE-2002-0985 Bypass 2002-09-24 2017-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.
9 CVE-2002-1396 DoS Exec Code Overflow 2003-01-17 2018-05-03
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code.
10 CVE-2002-2309 399 DoS 2002-12-31 2008-09-05
7.8
 None Remote Low Not required None None Complete
php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
11 CVE-2003-0097 Exec Code Bypass 2003-03-03 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.force_redirect or --enable-force-cgi-redirect).
12 CVE-2003-0166 DoS Exec Code 2003-04-02 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions.
13 CVE-2003-0172 Exec Code Overflow 2003-04-02 2017-07-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, allows remote attackers to cause a crash and possibly execute arbitrary code via a long filename argument.
14 CVE-2003-0249 2003-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
15 CVE-2003-0863 2003-11-17 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success value (0) when the safe_mode_include_dir variable is not specified in configuration, which differs from the previous failure value and may allow remote attackers to exploit file include vulnerabilities in PHP applications.
16 CVE-2004-0595 XSS 2004-07-27 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
17 CVE-2005-1042 Exec Code Overflow 2005-05-02 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.
18 CVE-2005-3390 Bypass 2005-11-01 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
19 CVE-2005-3391 Bypass 2005-11-01 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl and (2) ext/gd.
20 CVE-2005-3392 Bypass 2005-11-01 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
21 CVE-2006-0097 119 Exec Code Overflow 2006-01-06 2018-10-19
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.
22 CVE-2006-1015 2006-03-07 2018-10-30
6.4
 None Remote Low Not required Partial Partial None
Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE.
23 CVE-2006-1991 399 DoS 2006-04-24 2017-07-20
6.4
 None Remote Low Not required None Partial Partial
The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.
24 CVE-2006-4433 2006-08-29 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation.
25 CVE-2006-4481 Bypass 2006-08-31 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings. NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017.
26 CVE-2006-5178 362 Bypass 2006-10-10 2018-10-30
6.2
 None Local High Not required Complete Complete Complete
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via .. (dot dot) sequences, and then unlinking the resulting symlink.
27 CVE-2006-5465 Exec Code Overflow 2006-11-04 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.
28 CVE-2006-5706 Bypass 2006-11-04 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions. NOTE: the tempnam vector might overlap CVE-2006-1494.
29 CVE-2007-0905 Bypass 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
30 CVE-2007-0906 119 DoS Exec Code Overflow 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions. NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885). NOTE: as of 20070411, vector (3) might involve the imap_mail_compose function (CVE-2007-1825).
31 CVE-2007-0909 Exec Code 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.
32 CVE-2007-0911 DoS 2007-02-13 2018-10-16
7.8
 None Remote Low Not required None None Complete
Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).
33 CVE-2007-1001 189 Exec Code Overflow 2007-04-06 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values.
34 CVE-2007-1286 Exec Code Overflow 2007-03-06 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
35 CVE-2007-1376 2007-03-10 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate resource, as demonstrated by a GD Image resource.
36 CVE-2007-1381 119 Exec Code Overflow 2007-03-10 2008-09-05
7.6
 None Remote High Not required Complete Complete Complete
The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code via a WDDX packet with a malformed overlap of a STRING element, which triggers a buffer overflow.
37 CVE-2007-1396 2007-03-10 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The import_request_variables function in PHP 4.0.7 through 4.4.6, and 5.x before 5.2.2, when called without a prefix, does not prevent the (1) GET, (2) POST, (3) COOKIE, (4) FILES, (5) SERVER, (6) SESSION, and other superglobals from being overwritten, which allows remote attackers to spoof source IP address and Referer data, and have other unspecified impact. NOTE: it could be argued that this is a design limitation of PHP and that only the misuse of this feature, i.e. implementation bugs in applications, should be included in CVE. However, it has been fixed by the vendor.
38 CVE-2007-1401 Overflow +Priv 2007-03-10 2018-10-16
6.9
 None Local Medium Not required Complete Complete Complete
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allow local users to gain privileges via a long argument to the crack_opendict function.
39 CVE-2007-1411 Exec Code Overflow 2007-03-10 2018-10-19
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the (1) mssql_connect and (2) mssql_pconnect functions.
40 CVE-2007-1412 +Info 2007-03-12 2017-10-11
7.8
 None Remote Low Not required Complete None None
The cpdf_open function in the ClibPDF (cpdf) extension in PHP 4.4.6 allows context-dependent attackers to obtain sensitive information (script source code) via a long string in the second argument.
41 CVE-2007-1413 119 Exec Code Overflow 2007-03-12 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id).
42 CVE-2007-1453 Exec Code 2007-03-14 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filter_var with certain modes such as FILTER_VALIDATE_INT, which causes filter to write a null byte in whitespace that precedes the buffer.
43 CVE-2007-1461 264 2007-03-14 2011-07-13
7.8
 None Remote Low Not required Complete None None
The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories.
44 CVE-2007-1521 Exec Code 2007-03-20 2011-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.
45 CVE-2007-1522 Exec Code 2007-03-20 2011-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via illegal characters in a session identifier, which is rejected by an internal session storage module, which calls the session identifier generator with an improper environment, leading to code execution when the generator is interrupted, as demonstrated by triggering a memory limit violation or certain PHP errors.
46 CVE-2007-1582 Exec Code 2007-03-21 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD (ext/gd) extension and unspecified other extensions via a userspace error handler, which can be used to destroy and modify internal resources.
47 CVE-2007-1583 2007-03-21 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.
48 CVE-2007-1584 Exec Code Bypass 2007-03-21 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by passing an all-whitespace string to this function, which causes it to write '\0' characters in whitespace that precedes the string.
49 CVE-2007-1649 2007-03-24 2017-07-29
7.8
 None Remote Low Not required Complete None None
PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with S:, which does not properly track the number of input bytes being processed.
50 CVE-2007-1700 Exec Code 2007-03-27 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.
Total number of vulnerabilities : 300   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.