CVSS: 2.6EPSS: 1%CPEs: 49EXPL: 0CVE-2006-0208
https://notcve.org/view.php?id=CVE-2006-0208
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html http://rhn.redhat.com/errata/RHSA-2006-0276.html http://rhn.redhat.com/errata/RHSA-2006-0549.html http://secunia.com/advisories/18431 http://secunia.com/advisories/18697 http://secunia.com/advisories/19012 http://secunia.com/advisories/19179 http://secunia.com/advisories/19355 http://secunia.com/advisories/19832 http://secunia& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 11EXPL: 0CVE-2006-0207
https://notcve.org/view.php?id=CVE-2006-0207
Multiple HTTP response splitting vulnerabilities in PHP 5.1.1 allow remote attackers to inject arbitrary HTTP headers via a crafted Set-Cookie header, related to the (1) session extension (aka ext/session) and the (2) header function. • http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html http://secunia.com/advisories/18431 http://secunia.com/advisories/18697 http://secunia.com/advisories/19012 http://secunia.com/advisories/19179 http://secunia.com/advisories/19355 http://secunia.com/advisories/25945 http://securitytracker.com/id?1015484 http://www.debian.org/security/2007/dsa-1331 http://www.gentoo.org/security/en/glsa/glsa-200603-22.xml http://www.hardened-php.net/advisory_012006.1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 36EXPL: 0CVE-2005-3883
https://notcve.org/view.php?id=CVE-2005-3883
CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument. • ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc http://bugs.php.net/bug.php?id=35307 http://rhn.redhat.com/errata/RHSA-2006-0276.html http://secunia.com/advisories/17763 http://secunia.com/advisories/18054 http://secunia.com/advisories/18198 http://secunia.com/advisories/19832 http://secunia.com/advisories/20210 http://secunia.com/advisories/20951 http://securitytracker.com/id?1015296 http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm& •
CVSS: 7.5EPSS: 93%CPEs: 63EXPL: 1CVE-2005-3390 – PHP 4.x/5.0.x - Arbitrary File Upload GLOBAL Variable Overwrite
https://notcve.org/view.php?id=CVE-2005-3390
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field. • https://www.exploit-db.com/exploits/26443 http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522 http://rhn.redhat.com/errata/RHSA-2006-0549.html http://secunia.com/advisories/17371 http://secunia.com/advisories/17490 http://secunia.com/advisories/17510 http://secunia.com/advisories/17531 http://secunia.com/advisories/17557 http://secunia.com/advisories/17559 http://secunia.com/advisories/18054 http://secunia.com/advisories/18198 http://secunia.com/advisories/18669 •
CVSS: 5.0EPSS: 2%CPEs: 48EXPL: 0CVE-2005-3389
https://notcve.org/view.php?id=CVE-2005-3389
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected. • http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522 http://rhn.redhat.com/errata/RHSA-2006-0549.html http://secunia.com/advisories/17371 http://secunia.com/advisories/17490 http://secunia.com/advisories/17510 http://secunia.com/advisories/17531 http://secunia.com/advisories/17557 http://secunia.com/advisories/17559 http://secunia.com/advisories/18054 http://secunia.com/advisories/18198 http://secunia.com/advisories/18669 http://secunia.com/advisories/21252 http: •