PHP Code Issues Vulnerabilities

PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language jointly maintained by the PHP community. The language is primarily used for web development and supports a variety of databases and operating systems. A code issue exists in Php SoapClient, which can be...

CVE-2020-7071

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar$url, FILTERVALIDATEURL, PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong dat...

Security Bulletin: IBM API Connect V5 is vulnerable to sensitive information leak (CVE-2020-4899)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4899 DESCRIPTION: IBM API Connect could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive information across the network. CVSS Bas...

SEOPanel 4.6.0 Cross Site Scripting

Hello, We are informing you about Cross-Site Scripting Vulnerabilities in SEOPanel 4.6.0. Information -------------------- Advisory by Netsparker Name: Cross-Site Scripting Vulnerabilities in SEOPanel Affected Software: SEOPanel Affected Versions: 4.6.0 Vendor Homepage: https://www.seopanel.org/...

Security Bulletin: Authentication mechanism vulnerability affects IBM Connect:Direct for UNIX (CVE-2020-4747)

Summary IBM Connect:Direct for UNIX can allow a local or remote user to obtain an authenticated CLI session due to improper authentication methods. Vulnerability Details CVEID: CVE-2020-4747 DESCRIPTION: IBM Connect:Direct for UNIX can allow a local or remote user to obtain an authenticated CLI...

Schneider Electric EcoStruxure Operator Terminal Expert runtime (Vijeo XD)

1. EXECUTIVE SUMMARY CVSS v3 7.4 Vendor: Schneider Electric Equipment: EcoStruxure Operator Terminal Expert Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability may allow unauthorized command execution by a local user of the Windows...

PHP 7.4.x < 7.4.12 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is 7.3.x prior to 7.3.24 or 7.4.x prior to 7.4.12. It is, therefore, affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the...

CVE-2018-1725

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

CVE-2018-1725

IBM QRadar SIEM in a multi-tenant configuration is vulnerable to information disclosure (CVE-2018-1725). Affected products/versions: IBM QRadar SIEM 7.3.0–7.3.3 Patch 5 and 7.4.0–7.4.1 Patch 1. The IBM bulletin cites CVSS v3.0 vector CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N with a base score ...

CVE-2018-1725

IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440...

ALBA-2020:4717 new module: php:7.4

This enhancement update adds the php:7.4 module to AlmaLinux BZ1797661 For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

new module: php:7.4

An update is available for php-pear, php-pecl-rrd, php, php-pecl-apcu, php-pecl-xdebug, libzip, php-pecl-zip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Thi...

Security Bulletin: Dom4j as used by IBM QRadar SIEM contains multiple vulnerabilities (CVE-2018-1000632, CVE-2020-10683)

Summary Dom4j as used by IBM QRadar SIEM contains multiple vulnerabilities Vulnerability Details CVEID: CVE-2018-1000632 DESCRIPTION: dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods. By sending a specially-crafte...

PHP 7.4.x < 7.4.11 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilities: - When AES-CCM mode is used with opensslencrypt function with 12 byt...

PHP 7.4.x < 7.4.8 Information Disclosure

According to its self-reported version number, the version of PHP running on the remote Windows web server is 7.2.x prior to 7.2.32, 7.3.x prior to 7.3.20 or 7.4.x prior to 7.4.8. It is, therefore, affected by an information disclosure vulnerability. The libcurl library can be tricked to prepend ...

PHP 7.2 < 7.2.34 / 7.3.x < 7.3.23 / 7.4.x < 7.4.11 Mulitiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilties: - A weak cryptography vulnerability exists in PHP's opensslencrypt...

CVE-2020-4280

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...

CVE-2020-4280

IBM QRadar SIEM versions 7.3.x and 7.4.x are affected by an insecure deserialization vulnerability in the Java deserialization function. A remote attacker can send a malicious serialized Java object to the QRadar RemoteJavaScript Servlet to execute arbitrary commands on the affected system. The r...

CVE-2019-4545

CVE-2019-4545 affects IBM QRadar SIEM 7.3–7.4 when AD authentication is enabled. The issue is a Kerberos KDC spoofing vulnerability that can enable spoofing of authentication, as described in IBM’s advisory and derived CVSS data. Affected versions include QRadar 7.4.x and 7.3.x with AD config; im...

CVE-2020-4280

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...