139 matches found
PHP 7.2.x < 7.2.4 Dumpable FPM Child Processes
According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.4. It is, therefore, affected by opcache access controls bypass via dumpable FPM child processes. Note that the scanner has not tested for these issues but has instead relied only on the application...
PHP 5.x < 5.6.39, 7.x < 7.0.33, 7.1.x < 7.1.26, 7.2.x < 7.2.14 DoS Vulnerability - Windows
PHP is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...
Amazon Linux AMI : php72 (ALAS-2018-1067)
exifprocessIFDinMAKERNOTE in ext/exif/exif.c in PHP 7.2.x before 7.2.8 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted JPEG file.CVE-2018-14851 exifreadfromimpl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a...
PHP 7.x < 7.0.27, 7.1.x < 7.1.13, 7.2.0 Unspecified Vulnerability - Linux
PHP is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...
CVE-2018-14884
An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because httpheadervalue in ext/standard/httpfopenwrapper.c can be a NULL value that is mishandled in an atoi call...
McAfee Drive Encryption 7.1 < 7.1.3 HF1241165 or 7.2.x < 7.2.6 Authentication Bypass vulnerability
The remote host is running a version of McAfee Drive Encryption that is 7.1 7.1.3 HF1241165 or 7.2.x 7.2.6 that is affected by an authentication bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111531; scriptversion"1.5";...
CVE-2018-14851
exifprocessIFDinMAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted JPEG file...
Internet Bug Bounty: heap-buffer-overflow (READ of size 48) in exif_read_data()
exifreaddata in PHP 5.6.36, 7.1.x and 7.2.x is vulnerable to a heap buffer overflow when fed a specially crafted JPEG. Any online service that reads EXIF data from uploaded JPEGs is potentially vulnerable to this flaw. This has been fixed with the release of PHP 7.2.8 today. Other releases are...
CVE-2018-12882
exifreadfromimpl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free in exifreadfromfile because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exifreaddata function...
CVE-2018-12882
Removed by vendor...
CVE-2018-12882
exifreadfromimpl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free in exifreadfromfile because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exifreaddata function...
SECURITY BULLETIN: Webmin as used in IBM QRadar SIEM is vulnerable to Execute code as root. (CVE-2015-2011)
Summary The xmlrpc.cgi Webmin script allows arbitrary command execution and escalation of privileges. Vulnerability Details CVE-ID: CVE-2015-2011 Description: IBM QRadar could allow an authenticated user to execute code as root. CVSS Base Score:8.5 CVSS Temporal Score: See...
Security Bulletin: IBM QRadar SIEM is vulnerable to shell command injection vulnerability in the admin panel. (CVE-2015-4930, CVE-2015-2016 )
Summary IBM QRadar SIEM is vulnerable to a shell command injection the in admin panel if logged in as an admin user. Vulnerability Details CVE-ID: CVE-2015-4930 Description: IBM QRadar could allow a user authenticated with admin access, to execute commands on the server as root. CVSS Base Score:8...
Security Bulletin: Cross-Site Scripting vulnerability in QRadar (CVE-2014-3091)
Summary Reflected Cross-Site Scripting vulnerabilty found in IBM QRadar versions 7.1.x and 7.2.x. Vulnerability Details CVEID: CVE-2014-3091 DESCRIPTION: IBM QRadar is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
Code injection
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...
PHP 7.2.x < 7.2.1 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.1. It is, therefore, affected by the following vulnerabilities : - A denial of service DoS vulnerability exists in the imagecreatefromgif and imagecreatefromstring functions of the gdgifin.c script...
MySQL Cluster 7.2.x < 7.2.26 Multiple DoS (January 2017 CPU)
The version of MySQL Cluster running on the remote host is 7.2.x prior to 7.2.26. It is, therefore, affected by multiple denial of service vulnerabilities : - An overflow condition exists in the NDBAPI subcomponent that allows an unauthenticated, remote attacker to cause a denial of service...