CVSS: 4.3EPSS: 3%CPEs: 1EXPL: 0CVE-2007-5899 – php session ID leakage
https://notcve.org/view.php?id=CVE-2007-5899
The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID. La función output_add_rewrite_var en PHP anterior a 5.2.5 rescribe formularios locales en los cuales el atributo ACTION referencia a una URL no local, lo caul permite a atacantes remotos obtener información potencialmente sensible a través de la lectura de respuestas para esta URL, como se demostró por la rescritura del formulario contenedor de una sesión local ID. • http://bugs.php.net/bug.php?id=42869 http://osvdb.org/38918 http://secunia.com/advisories/27659 http://secunia.com/advisories/27864 http://secunia.com/advisories/28249 http://secunia.com/advisories/30040 http://secunia.com/advisories/30828 http://secunia.com/advisories/31119 http://secunia.com/advisories/31124 http://secunia.com/advisories/31200 http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242 http://www.debian.org/security/2008/dsa-1444 http://www.mandri • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 1CVE-2007-6039 – PHP 5.2.5 - Multiple GetText functions Denial of Service Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-6039
PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution. PHP 5.2.5 y anteriores permite a atacantes dependientes del contexto provocar denegación de servicio (caida de aplicación) a través de una cadena larga en (1) el parámetro domain en la función dgettext, el parámetro message en las funciones (2) dcgettext o (3) gettext, el parámetro msgid1 en las funciones (4) dngettext o (5) ngettext, o el parámetro (6) classname en la función stream_wrapper_register. NOTA: esto podría no ser una vulnerabilidad en muchos entornos de servidores web que soportan múltiples hilos, a menos que esta cuestión se pueda demostrar para la ejecución de código. • https://www.exploit-db.com/exploits/30760 http://securityreason.com/securityalert/3365 http://securityreason.com/securityalert/3366 http://www.securityfocus.com/archive/1/483644/100/0/threaded http://www.securityfocus.com/archive/1/483648/100/0/threaded http://www.securityfocus.com/bid/26426 http://www.securityfocus.com/bid/26428 https://exchange.xforce.ibmcloud.com/vulnerabilities/38442 https://exchange.xforce.ibmcloud.com/vulnerabilities/38443 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 2%CPEs: 1EXPL: 0CVE-2007-5898 – php htmlentities/htmlspecialchars multibyte sequences
https://notcve.org/view.php?id=CVE-2007-5898
The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465. Las funciones (1) htmlentities y (2) htmlspecialchars en PHP anterior a 5.2.5 acepta secuencias multibyte parciales, lo cual tiene un impacto desconocido y vectores de ataque, un asunto diferente que CVE-2006-5465. • http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html http://secunia.com/advisories/27648 http://secunia.com/advisories/27659 http://secunia.com/advisories/27864 http://secunia.com/advisories/28249 http://secunia.com/advisories/28658 http://secunia.com/advisories/30040 http://secunia.com/advisories/30828 http://secunia.com/advisories/31119 http://secunia.com/advisories/31124 http://secunia.com/advisories/31200 http://securitytracker.com/id?1018934 http:/ •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5900
https://notcve.org/view.php?id=CVE-2007-5900
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625. PHP anterior a 5.2.5 permite a usuarios locales evitar mecanismos de protección configurados a través de php_admin_value o php_admin_flag en httpd.conf con la utilización de ini_set para modificar variables de configuración de su elección, un asunto diferente que CVE-2006-4625. • http://bugs.php.net/bug.php?id=41561 http://secunia.com/advisories/27648 http://secunia.com/advisories/27659 http://secunia.com/advisories/30040 http://securitytracker.com/id?1018934 http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242 http://www.php.net/ChangeLog-5.php#5.2.5 http://www.php.net/releases/5_2_5.php http://www.securityfocus.com/archive/1/491693/100/0/threaded https://issues.rpath.com/browse/RPL-1943 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2007-5653 – PHP 5.x COM - Safe Mode / disable_functions Bypass
https://notcve.org/view.php?id=CVE-2007-5653
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function. Las funciones Component Object Model (COM) en PHP 5.x sobre Windows no siguen las restricciones safe_mode y disable_functions, lo cual permite a atacantes dependientes del contexto evitar las limitaciones intencionadas, como se demostró ejecutando objetos con el bit matar asignado en el correspondientes controlador ActiveX Compatibility Flags, ejecutando programas a través de una función en compatUI.dll, invocando wscript.shell a través de wscript.exe, invocando Scripting.FileSystemObject a través de wshom.ocx, y añadiendo usuarios a través de una función en shgina.dll, relacionado con la función com_load_typelib. • https://www.exploit-db.com/exploits/4553 http://secunia.com/advisories/27280 http://www.vupen.com/english/advisories/2007/3590 https://exchange.xforce.ibmcloud.com/vulnerabilities/37368 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •