CVSS: 4.3EPSS: 2%CPEs: 3EXPL: 2CVE-2003-0442 – PHP 4.x - Transparent Session ID Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2003-0442
Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la capacidad de soporte transparente de SID en PHP anteriores a 4.3.2 (session.use_trans_sid) permite a atacantes remotos insertar script arbitrario mediante el parámetro PHPSESSID • https://www.exploit-db.com/exploits/22696 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000691 http://marc.info/?l=bugtraq&m=105449314612963&w=2 http://marc.info/?l=bugtraq&m=105760591228031&w=2 http://shh.thathost.com/secadv/2003-05-11-php.txt http://www.ciac.org/ciac/bulletins/n-112.shtml http://www.debian.org/security/2003/dsa-351 http://www.mandriva.com/security/advisories?name=MDKSA-2003:082 http://www.osvdb.org/4758 http://www.redhat •
CVSS: 7.5EPSS: 8%CPEs: 17EXPL: 5CVE-2003-0166 – PHP 4.x - 'socket_recv()' Signed Integer Memory Corruption
https://notcve.org/view.php?id=CVE-2003-0166
Integer signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly other functions. • https://www.exploit-db.com/exploits/22425 https://www.exploit-db.com/exploits/22426 https://www.exploit-db.com/exploits/22419 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000691 http://marc.info/?l=bugtraq&m=104869828526885&w=2 http://marc.info/?l=bugtraq&m=104878100719467&w=2 http://marc.info/?l=bugtraq&m=104931415307111&w=2 http://www.securityfocus.com/bid/7197 http://www.securityfocus.com/bid/7198 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2003-0097
https://notcve.org/view.php?id=CVE-2003-0097
Unknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as the PHP user, and possibly execute PHP code, by bypassing the CGI force redirect settings (cgi.force_redirect or --enable-force-cgi-redirect). • http://marc.info/?l=bugtraq&m=104550977011668&w=2 http://marc.info/?l=bugtraq&m=104567042700840&w=2 http://marc.info/?l=bugtraq&m=104567137502557&w=2 http://www.iss.net/security_center/static/11343.php http://www.securityfocus.com/bid/6875 http://www.slackware.com/changelog/current.php?cpu=i386 •