snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:4128-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4128-1 advisory. This update for php7 fixes the following issue: - CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. Tenable has...

gha-lab-f1c8785cc8

Moderne DOM-API Dieses Projekt basiert auf dem nativen DOMDocument von PHP und bietet Zugriff auf moderne DOM-APIs, wie man es von clientseitigem Code im Browser gewohnt ist. Die Durchführung von DOM-Manipulationen im serverseitigen Code verbessert die Art und Weise, wie dynamische Seiten erstell...

CVE-2026-49286: Deserialization of Untrusted Data

PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, pontedilana/php-weasyprint guarded the output filename against the phar:// stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so PHAR://, Phar://, etc...

EUVD-2015-8736

Malware in sbrugna...

EUVD-2024-36064

Malicious code in bioql PyPI...

EUVD-2016-4184

Malicious code in bioql PyPI...

CVE-2018-18758

Open Faculty Evaluation System 7 for PHP 7 allows submitfeedback.php SQL Injection, a different vulnerability than CVE-2018-18757...

BIT-SUITECRM-2024-36407 SuiteCRM unauthenticated user password reset on php7

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...

CVE-2024-36407

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...

CVE-2024-36407 SuiteCRM unauthenticated user password reset on php7

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...

CVE-2024-36407

CVE-2024-36407 (SuiteCRM) : An unauthenticated attacker could trigger a password reset flow to a user due to a vulnerability in SuiteCRM prior to versions 7.14.4 and 8.6.1. The attacker does not obtain the new password, and exploitation depends on password-reset functionality being enabled, with ...

CVE-2024-36407 SuiteCRM unauthenticated user password reset on php7

SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is...

RHEL 8 : php (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - php: Out of bounds access in phppcre.c:phppcrereplaceimpl CVE-2017-9118 - php: 1-byte array overrun in...

Snappy PHAR deserialization vulnerability

Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the phar:// wrapper...

GHSA-92RV-4J2H-8MJJ Snappy PHAR deserialization vulnerability

Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the phar:// wrapper...

Snappy PHAR deserialization vulnerability

Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the phar:// wrapper...

WP Meta SEO < 4.5.5 - Author+ PHAR Deserialization

The plugin does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain configurations to achieve remote code execution. 1. Use a WordPress instance...

K95432245: PHP vulnerability CVE-2016-5768

Security Advisory Description Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service application...