Page 117 of 589 results (0.010 seconds)

CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 1

PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters. • https://www.exploit-db.com/exploits/20985 http://online.securityfocus.com/archive/1/194425 http://www.iss.net/security_center/static/6787.php http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz http://www.redhat.com/support/errata/RHSA-2002-102.html http://www.redhat.com/support/errata/RHSA-2002-129.html http://www.redhat.com/support/errata/RHSA-2003-159.html http://www.securityfocus.com/bid/2954 https://access.redhat.com/security/cve/CVE-2001&# • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •

CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0

PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000373 http://marc.info/?l=bugtraq&m=97957961212852 http://www.debian.org/security/2001/dsa-020 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-013.php3 http://www.redhat.com/support/errata/RHSA-2000-136.html http://www.securityfocus.com/bid/2206 https://exchange.xforce.ibmcloud.com/vulnerabilities/5940 •

CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0

The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000373 http://marc.info/?l=bugtraq&m=97957961212852 http://www.debian.org/security/2001/dsa-020 http://www.iss.net/security_center/static/5939.php http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-013.php3 http://www.redhat.com/support/errata/RHSA-2000-136.html http://www.securityfocus.com/bid/2205 •

CVSS: 10.0EPSS: 34%CPEs: 2EXPL: 3

PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs. • https://www.exploit-db.com/exploits/220 https://www.exploit-db.com/exploits/20286 ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:75.php.asc http://archives.neohapsis.com/archives/bugtraq/2000-10/0204.html http://www.atstake.com/research/advisories/2000/a101200-1.txt http://www.calderasystems.com/support/security/advisories/CSSA-2000-037.0.txt http://www.linux-mandrake.com/en/security/MDKSA-2000-062.php3?dis=7.1 http://www.redhat.com/support/errata/RHSA •

CVSS: 5.0EPSS: 0%CPEs: 18EXPL: 1

The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables. • http://archives.neohapsis.com/archives/bugtraq/2000-08/0455.html http://archives.neohapsis.com/archives/bugtraq/2000-08/0477.html http://archives.neohapsis.com/archives/bugtraq/2000-09/0150.html http://cvsweb.php.net/viewcvs.cgi/php4/main/rfc1867.c.diff?r1=1.38%3Aphp_4_0_2&tr1=1.1&r2=text&tr2=1.45&diff_format=u http://www.securityfocus.com/bid/1649 https://exchange.xforce.ibmcloud.com/vulnerabilities/5190 •