CVE-2002-0484

moveuploadedfile in PHP does not does not check for the base directory openbasedir, which could allow remote attackers to upload files to unintended locations on the system...

CVE-2002-0717

PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed...

CVE-2002-0717

PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory to be freed...

ISS Brief: Remote Compromise and Denial of Service Vulnerability in PHP

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- This document is an ISS X-Force Securit...

Advisory CA-2002-21 Vulnerability in PHP

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-21 Vulnerability in PHP Original release date: July 22, 2002 Last revised: -- Source: CERT/CC A complete revision history can be found at the end of this file. Systems Affected Systems running PHP versions 4.2.0 or 4.2.1 Overview A...

PHP Resource Exhaustion Denial of Service

The PHP interpreter is a heavy-duty CGI EXE or SAPI module, depending on configuration that implements an HTML-embedded script language. A vulnerability in PHP can be used to cause a denial of service in some cases. PHP's install process on Apache requires a "/php/" alias to be created, as it...

Advisory 02/2002: PHP remote vulnerability

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: Remote Compromise/DOS Vulnerability in PHP Release Date: 2002/07/22 Last Modified: 2002/07/22 Author: Stefan Esser [email protected] Application: PHP 4.2.0, 4.2.1 Severity: A vulnerability within the multipart/form-data handler...

PHP < 4.2.x mail Function CRLF Injection

The remote host is running a version of PHP earlier than 4.2.2. The new POST handling system in PHP 4.2.0 and 4.2.1 has a bug which allows an attacker to disable the remote server or to compromise it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from...

PHP fails to properly parse the headers of HTTP POST requests

Overview A vulnerability has been discovered in PHP. This vulnerability could be used by a remote attacker to execute arbitrary code or crash PHP and/or the web server. Description PHP is a popular scripting language in widespread use. For more information about PHP, see...

Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1

PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 Issued on: July 22, 2002 Software: PHP versions 4.2.0 and 4.2.1 Platforms: All The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with...

Several problems in CARE 2002

Several problems in CARE 2002 ------------------------------------- What is CARE 2002? CARE 2002 is a free software package for hospitals. It's based on php + mysql. For further information visit http://www.care2x.com/. include + NULL problem Problem description There are several include statemen...

CVE-2001-1247

PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the errorlog function to access the files...

CVE-2001-1297

PHP remote file inclusion vulnerability in Actionpoll PHP script before 1.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the includedir parameter...

CVE-2002-0253

PHP, when not configured with the "displayerrors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and...

Clicky Web Pseudo-frames 1.0 - Remote File Inclusion

source: https://www.securityfocus.com/bid/4756/info Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. If this file is a PHP script, it...

B2 0.6 - b2edit.showposts.php?b2inc Remote File Inclusion

B2 0.6 - b2edit.showposts.php?b2inc Remote File Inclusion source: https://www.securityfocus.com/bid/4673/info B2 is a news/weblog tool written in php. b2 allows webmasters to quickly post news on the frontpage, and let viewers interact with each other. It is available primarily for Unix and Linux...

Blahz-DNS 0.2 - Direct Script Call Authentication Bypass

Blahz-DNS 0.2 - Direct Script Call Authentication Bypass source: https://www.securityfocus.com/bid/4618/info Blahz-DNS is a web based management tool for DNS information. It is implemented in PHP, and available for Linux systems. By directly calling scripts included with Blahz-DNS, it is possible...

Blahz-DNS 0.2 - Direct Script Call Authentication Bypass

source: https://www.securityfocus.com/bid/4618/info Blahz-DNS is a web based management tool for DNS information. It is implemented in PHP, and available for Linux systems. By directly calling scripts included with Blahz-DNS, it is possible to bypass the authentication check, gaining full access ...

DNSTools 2.0 - Authentication Bypass

source: https://www.securityfocus.com/bid/4617/info DNSTools is a web based managment tool for DNS information. It is implemented in PHP, and available for Linux and Solaris. A vulnerability has been reported in some versions of DNSTools which allows any remote attacker to gain administrative...

PVote 1.01.5 - Poll Content Manipulation

PVote 1.01.5 - Poll Content Manipulation source: https://www.securityfocus.com/bid/4540/info PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems. It is possible for a remote attacker to add/delete web polls just b...