Browse CVEs

HIGH 7.0 CVE-2021-21703 In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process r… PHP 7.4.25 / 8.0.12+ Fix from $1,9502021-10-25 MEDIUM 6.5 CVE-2021-21706 In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked… PHP 7.3.31 / 7.4.24+ Fix from $1,6002021-10-04 MEDIUM 5.3 CVE-2021-21705 In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with … PHP 7.3.29 / 7.4.21+ Fix from $1,6002021-10-04 MEDIUM 5.9 CVE-2021-21704 In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server c… PHP 7.3.29 / 7.4.21+ Fix from $1,6002021-10-04 HIGH 7.1 CVE-2021-32610EPSS 73% In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. Archive Tar 1.4.14+ Fix from $1,9502021-07-30 HIGH 7.5 CVE-2021-21702 In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP… PHP 7.3.27 / 7.4.15+ Fix from $1,9502021-02-15 MEDIUM 5.3 CVE-2020-7071 In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP … PHP 7.3.26 / 7.4.14+ Fix from $1,6002021-02-15 HIGH 7.5 CVE-2020-36193 KEVEPSS 71% Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue … Archive Tar 7.78 / 8.9.13+ Fix from $1,9502021-01-18 HIGH 7.8 CVE-2020-28948EPSS 47% Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Archive Tar 1.4.11 / 7.75+ Fix from $1,9502020-11-19 HIGH 7.8 CVE-2020-28949 KEVEPSS 85% Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to o… Archive Tar 1.4.12 / 7.75+ Fix from $1,9502020-11-19 MEDIUM 6.5 CVE-2020-7069 In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 byte… PHP 5.19.0 / 7.2.34+ Fix from $1,6002020-10-02 MEDIUM 5.3 CVE-2020-7070EPSS 5% In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names a… PHP 5.19.0 / 7.2.34+ Fix from $1,6002020-10-02 MEDIUM 5.3 CVE-2019-11048EPSS 6% In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or … PHP 7.2.31 / 7.3.18+ Fix from $1,6002020-05-20 HIGH 7.5 CVE-2020-7067 In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function… PHP 5.19.0 / 7.2.30+ Fix from $1,9502020-04-27 HIGH 8.8 CVE-2020-7065 In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could … PHP 5.19.0 / 7.3.16+ Fix from $1,9502020-04-01 MEDIUM 5.4 CVE-2020-7064 In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible f… PHP 5.19.0 / 7.2.29+ Fix from $1,6002020-04-01 HIGH 7.5 CVE-2020-7062 In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is en… PHP after 7.4.2 Fix from $1,9502020-02-27 MEDIUM 5.3 CVE-2020-7063 In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function… PHP 5.19.0+ Fix from $1,6002020-02-27 CRITICAL 9.1 CVE-2020-7061 In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR fi… PHP 5.19.0+ Fix from $2,3002020-02-27 HIGH 7.5 CVE-2011-3336EPSS 6% regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. PHP after 10.7.2 Fix from $1,9502020-02-12 CRITICAL 9.1 CVE-2020-7059EPSS 7% When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is pos… PHP 5.19.0 / 7.2.27+ Fix from $2,3002020-02-10 CRITICAL 9.1 CVE-2020-7060EPSS 9% When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it… PHP 5.19.0 / 7.2.27+ Fix from $2,3002020-02-10 CRITICAL 9.8 CVE-2019-11049 In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4… PHP 5.19.0+ Fix from $2,3002019-12-23 MEDIUM 6.5 CVE-2019-11047EPSS 7% When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x belo… PHP 7.2.26 / 7.3.13+ Fix from $1,6002019-12-23 MEDIUM 6.5 CVE-2019-11050EPSS 8% When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x belo… PHP 5.19.0+ Fix from $1,6002019-12-23 MEDIUM 5.9 CVE-2019-11045EPSS 9% In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them… PHP 5.19.0+ Fix from $1,6002019-12-23 MEDIUM 5.3 CVE-2019-11046 In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked i… PHP 5.19.0+ Fix from $1,6002019-12-23 HIGH 7.5 CVE-2019-11044EPSS 5% In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats t… PHP 5.19.0+ Fix from $1,9502019-12-23 CRITICAL 9.8 CVE-2011-1939 SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction … PHP 1.10.9 / 1.11.6+ Fix from $2,3002019-11-26 HIGH 7.5 CVE-2019-19246 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. PHP 7.3.10+ Fix from $1,9502019-11-25