230 matches found
CVE-2020-7063
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator function, the files are added with default permissions 0666, or all access even if the original files on the filesystem were with more restrictive permissions...
Null pointer dereference
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...
CVE-2020-7062
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...
Medium: php72
Issue Overview: When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash...
Command injection
The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection...
CVE-2020-7064
In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash...
PT-2020-5322 · Php +7 · Php +7
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.27 PHP versions 7.3.x through 7.3.14 PHP versions 7.4.x through 7.4.2 Description: The issue is related to a null pointer dereference when using file upload functionality in PHP. If upload progress tracking is...
PHP 7.2.x < 7.2.26 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.26. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file read vulnerability exists in link and DirectoryIterator class due to improper handling of embedded \0 byte character a...
CVE-2013-7486
Cross-site scripting XSS vulnerability in the backend in Open-Xchange OX AppSuite 7.2.x before 7.2.2-rev27 and 7.4.x before 7.4.0-rev20 allows remote attackers to inject arbitrary web script or HTML via the body of an email. NOTE: this vulnerability was SPLIT from CVE-2013-6242 because it affects...
CVE-2019-11050
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure o...
CVE-2019-11046
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII...
PT-2019-5046 · Php +1 · Php +1
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.25 PHP versions 7.3.x through 7.3.12 PHP version 7.4.0 Description: The issue is related to the link function in PHP, which accepts filenames with embedded 0 byte and treats them as terminating at that byte. Thi...
PT-2019-4727 · Php +7 · Php +7
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.25 PHP versions 7.3.x through 7.3.12 PHP version 7.4.0 Description: The issue arises from the PHP DirectoryIterator class accepting filenames with embedded 0 byte and treating them as terminating at that byte...
Azure File Sync Agent v7.2 Release – July 2019 (KB4490497)
Update for Azure File Sync agent version 7.2.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v7.2 Release – July 2019 (KB4490497)
Update for Azure File Sync agent version 7.2.0.0. For more details, see the associated Microsoft Knowledge Base article...
PHP 7.2.x < 7.2.21 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.31, 7.2.x prior to 7.2.21 or 7.3.x prior to 7.3.8. It is, therefore, affected by the following vulnerabilities: - A heap-based buffer overflow condition exists on exifscanthumbnail. An attacker can...
PT-2019-10033 · Ibm · Ibm Qradar Siem
Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.2 through 7.3 Description: The issue allows a security-critical resource to be read or modified by unintended actors due to improper permission specifications. Recommendations: For IBM QRadar SIEM versions 7.2 throu...
Command injection
The OS Command Plugin in the transaction GPAADMIN and the OSCommand Console of SAP Diagnostic Agent LM-Service, version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application...
Default credentials
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to t...