CVSS: 5.0EPSS: 2%CPEs: 10EXPL: 3CVE-2004-1020 – PHP 4/5 - 'addslashes()' Null Byte Bypass
https://notcve.org/view.php?id=CVE-2004-1020
The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. ** RECHAZADA ** NO USE ESTE NÚMERO DE CANDIDATA. • https://www.exploit-db.com/exploits/24985 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915 http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml http://www.mandriva.com/security/advisories?name=MDKSA-2004:151 http://www.php.net/release_4_3_10.php http://www.securityfocus.com/advisories/9028 http://www.securityfocus.com/archive/1/384663 http://www.securityfocus.com/bid/11981 https://exchange.xforce.ibmcloud.com/vulnerabilities/18516 •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 2CVE-2004-1018 – PHP 3/4/5 - Multiple Local/Remote Vulnerabilities
https://notcve.org/view.php?id=CVE-2004-1018
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. ** RECHAZADA ** NO USE ESTE NÚMERO DE CANDIDATA. • https://www.exploit-db.com/exploits/24854 https://www.exploit-db.com/exploits/24855 http://marc.info/?l=bugtraq&m=110314318531298&w=2 http://www.hardened-php.net/advisories/012004.txt http://www.mandriva.com/security/advisories?name=MDKSA-2004:151 http://www.mandriva.com/security/advisories?name=MDKSA-2005:072 http://www.osvdb.org/12411 http://www.php.net/release_4_3_10.php http://www.redhat.com/support/errata/RHSA-2005-032.html http://www.redhat.com/support& •
CVSS: 5.0EPSS: 3%CPEs: 1EXPL: 1CVE-2004-0958 – PHP 4.x/5.0.1 - PHP_Variables Remote Memory Disclosure
https://notcve.org/view.php?id=CVE-2004-0958
php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC variables that end in an open bracket character, which causes PHP to calculate an incorrect string length. PHP anteriores a 5.0.2 permiten a atacantes remotos leer contenidos de memoria sensibles mediante variables (1) GET, (2) POST, o (3) COOKIE GPC que acaban en un carácter de apertura de corchete. • https://www.exploit-db.com/exploits/24656 http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0053.html http://marc.info/?l=bugtraq&m=109527531130492&w=2 http://secunia.com/advisories/12560 http://securitytracker.com/id?1011279 http://www.redhat.com/support/errata/RHSA-2004-687.html https://bugzilla.fedora.us/show_bug.cgi?id=2344 https://exchange.xforce.ibmcloud.com/vulnerabilities/17393 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10863&# •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2004-0959
https://notcve.org/view.php?id=CVE-2004-0959
rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that causes the "$_FILES" array to be modified. PHP anteriores a 5.0.2 permiten a usuarios locales subir ficheros a sitios de su elección mediante un script PHP con una cierta cabecera que hace que el array $_FILES sea modificado. • http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0054.html http://marc.info/?l=bugtraq&m=109534848430404&w=2 http://secunia.com/advisories/12560 http://securitytracker.com/id?1011307 http://www.redhat.com/support/errata/RHSA-2004-687.html https://bugzilla.fedora.us/show_bug.cgi?id=2344 https://exchange.xforce.ibmcloud.com/vulnerabilities/17392 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10961 https://access.redhat.com/security/cve/CVE •
CVSS: 5.1EPSS: 61%CPEs: 18EXPL: 1CVE-2004-0594 – PHP 4.3.7/5.0.0RC3 - 'memory_limit' Remote Overflow
https://notcve.org/view.php?id=CVE-2004-0594
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete. La funcionalidad memory_limit de PHP 4.x a 4.3.7 y 5.x a 5.0.0RC3, bajo ciertas condiciones, como cuando register_globals está habilitado, permite a atacantes remotos ejecutar código de su elección disparando un aborto por memory_limit de la función zend_hash_init y sobrescribiendo un puntero de destructor de HashTable antes de que la incialización de las estructuras de datos clave se haya completado. • https://www.exploit-db.com/exploits/660 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847 http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023908.html http://marc.info/?l=bugtraq&m=108981780109154&w=2 http://marc.info/?l=bugtraq&m=108982983426031&w=2 http://marc.info/?l=bugtraq&m=109051444105182&w=2 http://marc.info/? • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •