CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

PHP » PHP : Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2007-4783 20 DoS Exec Code 2007-09-10 2018-10-15
5.0
None Remote Low Not required None None Partial
The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
152 CVE-2007-4782 94 DoS Exec Code 2007-09-10 2018-10-15
5.0
None Remote Low Not required None None Partial
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "*[1]e" value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
153 CVE-2007-4670 2007-09-05 2018-10-03
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285.
154 CVE-2007-3998 20 DoS 2007-09-04 2018-10-26
5.0
None Remote Low Not required None None Partial
The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
155 CVE-2007-3790 DoS 2007-07-15 2017-09-29
5.8
None Remote Medium Not required None Partial Partial
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long argument.
156 CVE-2007-3205 2007-06-13 2018-10-16
5.0
None Remote Low Not required None Partial None
The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.
157 CVE-2007-3007 264 2007-06-04 2018-10-30
5.0
None Remote Low Not required Partial None None
PHP 5 before 5.2.3 does not enforce the open_basedir or safe_mode restriction in certain cases, which allows context-dependent attackers to determine the existence of arbitrary files by checking if the readfile function returns a string. NOTE: this issue might also involve the realpath function.
158 CVE-2007-2728 2007-05-16 2021-03-31
5.0
None Remote Low Not required Partial None None
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727.
159 CVE-2007-2510 119 Overflow 2007-05-09 2018-10-30
5.1
None Remote High Not required Partial Partial Partial
Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.
160 CVE-2007-2369 Dir. Trav. 2007-04-30 2017-10-11
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
161 CVE-2007-1900 2007-04-10 2017-10-11
5.0
None Remote Low Not required None Partial None
CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.
162 CVE-2007-1824 DoS Overflow 2007-04-02 2017-07-29
5.1
None Remote High Not required Partial Partial Partial
Buffer overflow in the php_stream_filter_create function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service (application crash) via a php://filter/ URL that has a name ending in the '.' character.
163 CVE-2007-1717 2007-03-28 2018-10-30
5.0
None Remote Low Not required None Partial None
The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0') byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages. NOTE: this issue might be security-relevant in cases when the trailing contents of e-mail messages are important, such as logging information or if the message is expected to be well-formed.
164 CVE-2007-1475 Exec Code Overflow 2007-03-16 2018-10-19
5.4
None Local Network Medium Not required Partial Partial Partial
Multiple buffer overflows in the (1) ibase_connect and (2) ibase_pconnect functions in the interbase extension in PHP 4.4.6 and earlier allow context-dependent attackers to execute arbitrary code via a long argument.
165 CVE-2007-1460 264 2007-03-14 2011-05-24
5.0
None Remote Low Not required Partial None None
The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories.
166 CVE-2007-1452 Bypass 2007-03-14 2008-09-05
5.0
None Remote Low Not required None Partial None
The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST.
167 CVE-2007-1380 +Info 2007-03-10 2018-10-30
5.0
None Remote Low Not required Partial None None
The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.
168 CVE-2007-1379 Exec Code 2007-03-10 2018-10-30
5.1
None Remote High Not required Partial Partial Partial
The ovrimos_close function in the Ovrimos extension for PHP before 4.4.5 can trigger efree of an arbitrary address, which might allow context-dependent attackers to execute arbitrary code.
169 CVE-2007-1378 2007-03-10 2018-10-30
5.1
None Remote High Not required Partial Partial Partial
The ovrimos_longreadlen function in the Ovrimos extension for PHP before 4.4.5 allows context-dependent attackers to write to arbitrary memory locations via the result_id and length arguments.
170 CVE-2007-1375 Overflow 2007-03-10 2017-10-11
5.0
None Remote Low Not required Partial None None
Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value in the length argument, a different vulnerability than CVE-2006-1991.
171 CVE-2007-1285 119 DoS Overflow 2007-03-06 2018-10-30
5.0
None Remote Low Not required None None Partial
The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
172 CVE-2007-0908 20 2007-02-13 2018-10-30
5.0
None Remote Low Not required Partial None None
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
173 CVE-2007-0907 DoS 2007-02-13 2018-10-30
5.0
None Remote Low Not required None None Partial
Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.
174 CVE-2006-7243 20 Bypass 2011-01-18 2018-10-30
5.0
None Remote Low Not required None Partial None
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.
175 CVE-2006-4023 Overflow Sql +Info 2006-08-09 2018-10-17
5.0
None Remote Low Not required Partial None None
The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class of implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a security-relevant manner.
176 CVE-2006-1990 Exec Code Overflow 2006-04-24 2018-10-18
5.0
None Remote Low Not required None None Partial
Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.
177 CVE-2006-1490 2006-03-29 2018-10-30
5.0
None Remote Low Not required Partial None None
PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.
178 CVE-2006-0207 94 Http R.Spl. 2006-01-13 2018-10-30
5.0
None Remote Low Not required None Partial None
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function.
179 CVE-2005-3883 2005-11-29 2018-10-30
5.0
None Remote Low Not required None Partial None
CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.
180 CVE-2005-3389 2005-11-01 2018-10-30
5.0
None Remote Low Not required None Partial None
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
181 CVE-2005-3353 DoS 2005-11-18 2018-10-30
5.0
None Remote Low Not required None None Partial
The exif_read_data function in the Exif module in PHP before 4.4.1 allows remote attackers to cause a denial of service (infinite loop) via a malformed JPEG image.
182 CVE-2005-1043 DoS 2005-04-14 2018-10-30
5.0
None Remote Low Not required None None Partial
exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.
183 CVE-2005-0525 DoS 2005-05-02 2018-05-03
5.0
None Remote Low Not required None None Partial
The php_next_marker function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a JPEG image with an invalid marker value, which causes a negative length value to be passed to php_stream_seek.
184 CVE-2005-0524 DoS 2005-05-02 2018-05-03
5.0
None Remote Low Not required None None Partial
The php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.
185 CVE-2004-1392 Bypass 2004-12-31 2017-10-11
5.0
None Remote Low Not required Partial None None
PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
186 CVE-2004-1020 Dir. Trav. 2005-01-10 2017-07-11
5.0
None Remote Low Not required Partial None None
The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
187 CVE-2004-0958 2004-11-03 2017-10-11
5.0
None Remote Low Not required Partial None None
php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length.
188 CVE-2004-0594 Exec Code 2004-07-27 2018-10-30
5.1
None Remote High Not required Partial Partial Partial
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
189 CVE-2003-1303 DoS Exec Code Overflow 2003-12-31 2018-10-30
5.0
None Remote Low Not required None None Partial
Buffer overflow in the imap_fetch_overview function in the IMAP functionality (php_imap.c) in PHP before 4.3.3 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long e-mail address in a (1) To or (2) From header.
190 CVE-2003-1302 DoS 2003-12-31 2018-10-30
5.0
None Remote Low Not required None None Partial
The IMAP functionality in PHP before 4.3.1 allows remote attackers to cause a denial of service via an e-mail message with a (1) To or (2) From header with an address that contains a large number of "\" (backslash) characters.
191 CVE-2002-2215 DoS 2002-12-31 2008-09-05
5.0
None Remote Low Not required None None Partial
The imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers to cause a denial of service via an e-mail message with a large number of "To" addresses, which triggers an error in the rfc822_write_address function.
192 CVE-2002-2214 DoS 2002-12-31 2008-09-05
5.0
None Remote Low Not required None None Partial
The php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows remote attackers to cause a denial of service (crash) via an e-mail header with a long "To" header.
193 CVE-2002-1783 2002-12-31 2017-07-11
5.0
None Remote Low Not required None Partial None
CRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows remote attackers to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file functions.
194 CVE-2002-0986 2002-09-24 2017-10-10
5.0
None Remote Low Not required None Partial None
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
195 CVE-2002-0484 2002-08-12 2016-10-18
5.0
None Remote Low Not required None Partial None
move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.
196 CVE-2002-0253 2002-05-29 2016-10-18
5.0
None Remote Low Not required Partial None None
PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and produces an error message that contains the path.
197 CVE-2001-1385 2001-01-12 2016-10-18
5.0
None Remote Low Not required Partial None None
The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
198 CVE-2001-0108 Bypass 2001-03-12 2017-10-10
5.0
None Remote Low Not required Partial None None
PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
199 CVE-2000-0860 2000-11-14 2017-10-10
5.0
None Remote Low Not required Partial None None
The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables.
Total number of vulnerabilities : 198   Page : 1 2 3 4 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.