Armorize-ADV-2006-0009.txt

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

XSS Vulnerability in Zend Framework Preview 0.2.0

Armorize Technologies Security Advisory Advisory No: Armorize-ADV-2006-0009 Status: Partial Date: 2006/11/03 Summary: Armorize-ADV-2006-0009 discloses cross-site scripting vulnerability that is found in the sample codes of Zend Framework http://framework.zend.com/, which aims to provide a complet...

Zend平台多个远程漏洞

Zend Platform是企业级PHP应用的运行时平台环境。 Zend平台所捆绑的会话集群系统中存在多个漏洞，可能导致会话集群守护程序崩溃，会话函数无法工作，被攻击的节点拒绝服务。如果创建了特制的会话ID的话，攻击者还可以在会话集群守护程序的环境中或modcluster模块中执行任意代码。...

USN-362-1: PHP vulnerabilities

The stripos function did not check for invalidly long or empty haystack strings. In an application that uses this function on arbitrary untrusted data this could be exploited to crash the PHP interpreter. CVE-2006-4485 An integer overflow was discovered in the PHP memory allocation handling. On...

CVE-2006-4812

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function Zend/zendalloc.c...

CVE-2006-4812

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function Zend/zendalloc.c...

CVE-2006-4812

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function Zend/zendalloc.c...

Advisory 09/2006: PHP unserialize() Array Creation Integer Overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHP unserialize Array Creation Integer Overflow Release Date: 2006/10/09 Last Modified: 2006/10/09 Author: Stefan Esser [email protected] Application: PHP 5 = 5.1.6, PHP...

security flaw

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function Zend/zendalloc.c...

security flaw

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function Zend/zendalloc.c...

FreeBSD : joomla -- multiple vulnerabilities (0ab423e7-3822-11db-81e1-000e0c2e438a)

The Joomla development team reports multiple vulnerabilities within the joomla application. Joomla is vulnerable to the following vulnerabilities : - Improper validation of the mosMail function - Improper validation of the JosIsValidEmail function. - Remote code execution in PEAR.php - Zend Hash...

CVE-2006-4432

Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot sequence in the final component of the PHP session identifier PHPSESSID. NOTE: in some cases, this issue can be leveraged to perform direct static code...

CVE-2006-4431

Multiple buffer overflows in the a Session Clustering Daemon and the b modcluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service crash or execute arbitrary code via a 1 empty or 2 crafted PHP session identifier PHPSESSID...

CVE-2006-4432

Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot sequence in the final component of the PHP session identifier PHPSESSID. NOTE: in some cases, this issue can be leveraged to perform direct static code...

CVE-2006-4431

Multiple buffer overflows in the a Session Clustering Daemon and the b modcluster module in the Zend Platform 2.2.1 and earlier allow remote attackers to cause a denial of service crash or execute arbitrary code via a 1 empty or 2 crafted PHP session identifier PHPSESSID...

CVE-2006-4431

CVE-2006-4431 affects Zend Platform (Session Clustering Daemon) and the mod_cluster module; versions 2.2.1 and earlier are vulnerable. The issue is multiple buffer overflows triggered by a PHPSESSID that is empty or crafted, allowing remote attackers to crash the service (DoS) or potentially exec...

CVE-2006-4432

The CVE-2006-4432 entry describes a directory traversal in Zend Platform 2.2.1 and earlier. An attacker can overwrite arbitrary files by supplying a .. in the final PHPSESSID component, enabling potential direct static code injection in some cases. The affected product is Zend Platform (versions ...

joomla -- multiple vulnerabilities

The Joomla development team reports multiple vulnerabilities within the joomla application. Joomla is vulnerable to the following vulnerabilities: Improper validation of the mosMail function Improper validation of the JosIsValidEmail function. Remote code execution in PEAR.php Zend Hash del key o...

Zend Session Clustering Daemon Detection

The remote host is running a Zend Session Clustering daemon, a component of the Zend Platform used to synchronize session data across a cluster of PHP servers. %NASLMINLEVEL 70300 C Tenable Network Security include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid22270;...

[Full-disclosure] PHP: Zend_Hash_Del_Key_Or_Index Vulnerability

ZendHashDelKeyOrIndex Vulnerability In late January 2006 we had discovered a weakness within the depths of the implementation of hashtables in the Zend Engine that has a huge impact on the security of PHP scripts. While this vulnerability had been fixed immediately within the PHP CVS it took 6...