CVSS: 5.0EPSS: 22%CPEs: 75EXPL: 1CVE-2006-1490 – PHP 4.x/5.x - 'Html_Entity_Decode()' Information Disclosure
https://notcve.org/view.php?id=CVE-2006-1490
PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents. • https://www.exploit-db.com/exploits/27508 ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://bugs.gentoo.org/show_bug.cgi?id=127939 http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113 http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?view=log http://docs.info.apple.com/article.html?artnum=304829 http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html http://rhn.redhat.com/erra •
CVSS: 3.2EPSS: 0%CPEs: 30EXPL: 2CVE-2006-1014 – PHP 4.x/5.0/5.1 - 'mb_send_mail()' Restriction Bypass
https://notcve.org/view.php?id=CVE-2006-1014
Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by providing extra -C and -X arguments to sendmail. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE. • https://www.exploit-db.com/exploits/27335 http://secunia.com/advisories/18694 http://secunia.com/advisories/19979 http://www.novell.com/linux/security/advisories/05-05-2006.html http://www.osvdb.org/23534 http://www.securityfocus.com/archive/1/426342/100/0/threaded http://www.securityfocus.com/bid/16878 http://www.vupen.com/english/advisories/2006/0772 •
CVSS: 6.4EPSS: 7%CPEs: 75EXPL: 1CVE-2006-1015 – PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_param' Arbitrary File Creation
https://notcve.org/view.php?id=CVE-2006-1015
Argument injection vulnerability in certain PHP 3.x, 4.x, and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mail function, allows remote attackers to read and create arbitrary files via the sendmail -C and -X arguments. NOTE: it could be argued that this is a class of technology-specific vulnerability, instead of a particular instance; if so, then this should not be included in CVE. • https://www.exploit-db.com/exploits/27334 http://secunia.com/advisories/19979 http://securityreason.com/securityalert/517 http://www.novell.com/linux/security/advisories/05-05-2006.html http://www.securityfocus.com/archive/1/426497/100/0/threaded http://www.securityfocus.com/bid/16878 •
CVSS: 9.3EPSS: 13%CPEs: 78EXPL: 0CVE-2006-1017
https://notcve.org/view.php?id=CVE-2006-1017
The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions. • http://bugs.php.net/bug.php?id=37265 http://secunia.com/advisories/18694 http://secunia.com/advisories/21050 http://secunia.com/advisories/21546 http://securityreason.com/securityalert/516 http://www.mandriva.com/security/advisories?name=MDKSA-2006:122 http://www.osvdb.org/23535 http://www.php.net/ChangeLog-5.php#5.1.5 http://www.php.net/release_5_1_5.php http://www.securityfocus.com/archive/1/426339/100/0/threaded http://www.vupen.com/english/advisories&# •
CVSS: 2.6EPSS: 1%CPEs: 49EXPL: 0CVE-2006-0208
https://notcve.org/view.php?id=CVE-2006-0208
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html http://rhn.redhat.com/errata/RHSA-2006-0276.html http://rhn.redhat.com/errata/RHSA-2006-0549.html http://secunia.com/advisories/18431 http://secunia.com/advisories/18697 http://secunia.com/advisories/19012 http://secunia.com/advisories/19179 http://secunia.com/advisories/19355 http://secunia.com/advisories/19832 http://secunia& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •