CVE-2004-1063

PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safemodeexecdir restrictions and execute commands outside of the intended safemodeexecdir via shell metacharacters in the current directory name. NOTE: this issue was...

CVE-2004-1018

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via 1 a negative offset value to the shmopwrite function, 2 an "integer overflow/underflow" in the pack function, or 3 an "integer...

CVE-2004-0285

PHP remote file inclusion vulnerabilities in include/footer.inc.php in 1 AllMyVisitors, 2 AllMyLinks, and 3 AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the AMVconfigcfgserverpath parameter...

CVE-2004-0246

Multiple PHP remote file inclusion vulnerabilities in 1 fonctions.lib.php, 2 dernierscommentaires.php, and 3 admin.php in Les Commentaires 2.0 allow remote attackers to execute arbitrary PHP code via the rep parameter...

silentstorm.txt

CHT Security Research-2004 http://www.CyberSpy.Org Turkey Software: Silent Storm Portal Web Site: http://www.silent-storm.co.uk/ssp/ Affected Versions: 2.1,2.2 Description: Silent Storm Portal is a PHP based portal system.It requires PHP4 or above.no MySQL needed. Multiple Vulnerabilities in Sile...

PHP: Memory disclosure and arbitrary location file upload

Background PHP is a general-purpose scripting language widely used to develop web-based applications. It can run inside a web server using the modphp module or the CGI version of PHP, or can run stand-alone in a CLI. Description Stefano Di Paola discovered two bugs in PHP. The first is a parse...

Debian DSA-531-1 : php4 - several vulnerabilities

Two vulnerabilities were discovered in php4 : - CAN-2004-0594 The memorylimit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when registerglobals is enabled, allows remote attackers to execute arbitrary code by triggering a memorylimit abort during...

[VulnWatch] PHP Vulnerability N. 1

Hi all, This summer i have been playing around with some php issue and got some php vulnerabilities.. Let's go for the first one: ========================================================== Title: phpsuperinfo. Affected: Php = 5.0.1 Not Affected: it seems Php = 4.1.2 Vulnerability Type: Exposure o...

CVE-2002-1396

Heap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow attackers to cause a denial of service or execute arbitrary code...

GLSA-200407-13 : PHP: Multiple security vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200407-13 PHP: Multiple security vulnerabilities Several security vulnerabilities were found and fixed in version 4.3.8 of PHP. The striptags function, used to sanitize user input, could in certain cases allow tags containing \0...

PHP < 4.3.2 Multiple Function Remote Overflows

Binary data 1484.prm...

SUSE-SA:2004:021: php4/mod_php4

The remote host is missing the patch for the advisory SUSE-SA:2004:021 php4/modphp4. PHP is a well known, widely-used scripting language often used within web server setups. Stefan Esser found a problem with the 'memorylimit' handling of PHP which allows remote attackers to execute arbitrary code...

PHP: Multiple security vulnerabilities

Background PHP is a general-purpose scripting language widely used to develop web-based applications. It can run inside a web server using the modphp module or the CGI version of PHP, or can run stand-alone in a CLI. Description Several security vulnerabilities were found and fixed in version 4.3...

PHP < 4.3.8 Multiple Vulnerabilities

According to its banner, the version of PHP 4.3.x installed on the remote host is prior to 4.3.7. It is, therefore, potentially affected by a bug that could allow an attacker to execute arbitrary code on the remote host if the option memorylimit is set. Another bug in the function striptags may...

RHEL 2.1 : php (RHSA-2002:214)

PHP versions up to and including 4.2.2 contain vulnerabilities in the mail function, allowing local script authors to bypass safe mode restrictions and possibly allowing remote attackers to insert arbitrary mail headers or content. Updated 13 Jan 2003 Added fixed packages for the Itanium IA64...

waraxe-2004-SA012.txt

================================================================================ waraxe-2004-SA012 ================================================================================ Multiple vulnerabilities in XMB 1.8 Partagium SP3 and 1.9 Nexus Beta...

CVE-2004-0246

Multiple PHP remote file inclusion vulnerabilities in 1 fonctions.lib.php, 2 dernierscommentaires.php, and 3 admin.php in Les Commentaires 2.0 allow remote attackers to execute arbitrary PHP code via the rep parameter...

CVE-2004-0132

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server, as demonstrated using 1 the GLOBALSrootdp parameter to db.php, or 2 the GLOBALSlanguagehome parameter to archivednews.php, and a...

CVE-2004-0132

Multiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote web server, as demonstrated using 1 the GLOBALSrootdp parameter to db.php, or 2 the GLOBALSlanguagehome parameter to archivednews.php, and a...

CVE-2003-1459

Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the 1 template parameter in News.php or 2 installdir parameter in install.php...