PHP : Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2013-1643	200		+Info	2013-03-06	2013-04-10	5.0	None	Remote	Low	Not required	Partial	None	None
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
2	CVE-2012-6113	200		+Info	2013-01-19	2013-02-02	5.0	None	Remote	Low	Not required	Partial	None	None
The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.
3	CVE-2012-3365	264		Bypass	2012-07-20	2013-04-18	5.0	None	Remote	Low	Not required	None	Partial	None
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
4	CVE-2012-2336	20		DoS	2012-05-11	2012-07-21	5.0	None	Remote	Low	Not required	None	None	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
5	CVE-2012-2329	119		DoS Overflow	2012-05-11	2012-06-08	5.0	None	Remote	Low	Not required	None	None	Partial
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
6	CVE-2012-1172	20		DoS Dir. Trav.	2012-05-23	2012-09-21	5.8	None	Remote	Medium	Not required	None	Partial	Partial
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
7	CVE-2012-0789	399		DoS	2012-02-14	2012-06-27	5.0	None	Remote	Low	Not required	None	None	Partial
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
8	CVE-2012-0788	20		DoS	2012-02-14	2012-06-27	5.0	None	Remote	Low	Not required	None	None	Partial
The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
9	CVE-2012-0781	399	1	DoS	2012-01-18	2012-06-27	5.0	None	Remote	Low	Not required	None	None	Partial
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
10	CVE-2011-4885	20	2	DoS	2011-12-29	2012-11-06	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
11	CVE-2011-4153	20	1	DoS	2012-01-18	2012-07-21	5.0	None	Remote	Low	Not required	None	None	Partial
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
12	CVE-2011-3267	399		DoS	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.
13	CVE-2011-3182			DoS Overflow	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.
14	CVE-2011-2483	310			2011-08-25	2012-02-08	5.0	None	Remote	Low	Not required	Partial	None	None
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
15	CVE-2011-1657	399		DoS	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.
16	CVE-2011-1467			DoS	2011-03-19	2011-10-20	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409.
17	CVE-2011-1466	189		DoS Overflow	2011-03-19	2012-11-05	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.
18	CVE-2011-0755	189		Overflow	2011-02-02	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.
19	CVE-2011-0752	20		Bypass	2011-02-02	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
20	CVE-2011-0420		1	DoS	2011-02-18	2011-10-20	5.0	None	Remote	Low	Not required	None	None	Partial
The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service (crash) via an invalid size argument, which triggers a NULL pointer dereference.
21	CVE-2010-4699	189		Bypass	2011-01-18	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ks_c_5601-1987 character set.
22	CVE-2010-4698	119		DoS Overflow	2011-01-18	2011-08-01	5.0	None	Remote	Low	Not required	None	None	Partial
Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.
23	CVE-2010-4645	189		DoS	2011-01-10	2012-08-13	5.0	None	Remote	Low	Not required	None	None	Partial
strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308.
24	CVE-2010-4409	189	1	DoS Overflow	2010-12-06	2012-06-22	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument.
25	CVE-2010-4150	399		DoS Exec Code Mem. Corr.	2010-12-07	2011-07-18	5.0	None	Remote	Low	Not required	None	None	Partial
Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
26	CVE-2010-3436	264		Bypass	2010-11-08	2011-10-20	5.0	None	Remote	Low	Not required	None	Partial	None
fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
27	CVE-2010-3065	264			2010-08-20	2010-12-10	5.0	None	Remote	Low	Not required	None	Partial	None
The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.
28	CVE-2010-3063	119		Overflow	2010-08-20	2010-12-07	5.0	None	Remote	Low	Not required	None	Partial	None
The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.
29	CVE-2010-3062	200		Overflow +Info	2010-08-20	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the php_mysqlnd_ok_read function; or (2) trigger a heap-based buffer overflow via a modified length value, which is not properly handled by the php_mysqlnd_rset_header_read function.
30	CVE-2010-2484	200		Mem. Corr. +Info	2010-08-20	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.
31	CVE-2010-2190	200		+Info	2010-06-07	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
32	CVE-2010-2101	200		+Info	2010-05-27	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
33	CVE-2010-2100	200		+Info	2010-05-27	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
34	CVE-2010-2097	200		+Info	2010-05-27	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
35	CVE-2010-2093	399		DoS	2010-05-27	2010-12-07	5.0	None	Remote	Low	Not required	None	None	Partial
Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.
36	CVE-2010-1917	399		DoS	2010-05-12	2011-05-03	5.0	None	Remote	Low	Not required	None	None	Partial
Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.
37	CVE-2010-1915	200		+Info	2010-05-12	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.
38	CVE-2010-1914	200		+Info	2010-05-12	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode (shift_right_function), related to the convert_to_long_base function.
39	CVE-2010-1864	200		+Info	2010-05-07	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
40	CVE-2010-1862	200		+Info	2010-05-07	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
41	CVE-2010-1860	200		Mem. Corr. +Info	2010-05-07	2010-12-07	5.0	None	Remote	Low	Not required	Partial	None	None
The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.
42	CVE-2010-1130	264		Bypass	2010-03-26	2010-06-08	5.0	None	Remote	Low	Not required	None	Partial	None
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
43	CVE-2010-0397			DoS	2010-03-16	2010-12-10	5.0	None	Remote	Low	Not required	None	None	Partial
The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.
44	CVE-2009-4418	189		DoS	2009-12-24	2009-12-28	5.0	None	Remote	Low	Not required	None	None	Partial
The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.
45	CVE-2009-4017			DoS File Inclusion	2009-11-23	2011-07-18	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.
46	CVE-2009-3557	264		Bypass	2009-11-23	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments.
47	CVE-2009-3294	134		DoS	2009-09-22	2009-11-25	5.0	None	Remote	Low	Not required	None	None	Partial
The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.
48	CVE-2009-1272	20		DoS	2009-04-08	2009-09-16	5.0	None	Remote	Low	Not required	None	None	Partial
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.
49	CVE-2009-1271			DoS	2009-04-08	2009-09-16	5.0	None	Remote	Low	Not required	None	None	Partial
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.
50	CVE-2008-5498	200		+Info	2008-12-26	2010-08-21	5.0	None	Remote	Low	Not required	Partial	None	None
Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.

Total number of vulnerabilities : 110 Page : 1 (This Page)2 3