Логотип exploitDog
product: "php"
Консоль
Логотип exploitDog

exploitDog

product: "php"
PHP

PHPпопулярный язык сценариев общего назначения, особенно подходящий для веб-разработки.

Релизный цикл, информация об уязвимостях

Продукт: PHP
Вендор: php

График релизов

8.28.38.48.5202220232024202520262027202820292030

Недавние уязвимости PHP

Количество 3 883

debian логотип

CVE-2020-7067

почти 6 лет назад

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below ...

CVSS3: 7.5
EPSS: Низкий
ubuntu логотип

CVE-2020-7067

почти 6 лет назад

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

CVSS3: 7.5
EPSS: Низкий
fstec логотип

BDU:2020-05806

почти 6 лет назад

Уязвимость функции urldecode() интерпретатора языка программирования PHP, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю получить доступ к защищаемой информации

CVSS3: 7.5
EPSS: Низкий
redhat логотип

CVE-2020-7067

почти 6 лет назад

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

CVSS3: 5.9
EPSS: Низкий
nvd логотип

CVE-2020-7066

почти 6 лет назад

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

CVSS3: 5.3
EPSS: Низкий
debian логотип

CVE-2020-7066

почти 6 лет назад

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below ...

CVSS3: 5.3
EPSS: Низкий
nvd логотип

CVE-2020-7065

почти 6 лет назад

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

CVSS3: 7.4
EPSS: Низкий
debian логотип

CVE-2020-7065

почти 6 лет назад

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using ...

CVSS3: 7.4
EPSS: Низкий
nvd логотип

CVE-2020-7064

почти 6 лет назад

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

CVSS3: 6.5
EPSS: Низкий
debian логотип

CVE-2020-7064

почти 6 лет назад

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below ...

CVSS3: 6.5
EPSS: Низкий

Уязвимостей на страницу

Уязвимость
CVSS
EPSS
Опубликовано
1
debian логотип
CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below ...

CVSS3: 7.5
10%
Низкий
почти 6 лет назад
ubuntu логотип
CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

CVSS3: 7.5
10%
Низкий
почти 6 лет назад
fstec логотип
BDU:2020-05806

Уязвимость функции urldecode() интерпретатора языка программирования PHP, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю получить доступ к защищаемой информации

CVSS3: 7.5
10%
Низкий
почти 6 лет назад
redhat логотип
CVE-2020-7067

In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.

CVSS3: 5.9
10%
Низкий
почти 6 лет назад
nvd логотип
CVE-2020-7066

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

CVSS3: 5.3
2%
Низкий
почти 6 лет назад
debian логотип
CVE-2020-7066

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below ...

CVSS3: 5.3
2%
Низкий
почти 6 лет назад
nvd логотип
CVE-2020-7065

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.

CVSS3: 7.4
5%
Низкий
почти 6 лет назад
debian логотип
CVE-2020-7065

In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using ...

CVSS3: 7.4
5%
Низкий
почти 6 лет назад
nvd логотип
CVE-2020-7064

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

CVSS3: 6.5
2%
Низкий
почти 6 лет назад
debian логотип
CVE-2020-7064

In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below ...

CVSS3: 6.5
2%
Низкий
почти 6 лет назад

Уязвимостей на страницу


Поделиться