PHP Group PHP

• CVE-2024-5585 High 7.7 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) 28.8%
• CVE-2024-5458 Medium 5.3 Filter bypass in filter_var (FILTER_VALIDATE_URL) 12.1%
• CVE-2024-1874 Critical 9.4 Command injection via array-ish $command parameter of proc_open() 32.8%
• CVE-2024-2757 High 7.5 PHP mb_encode_mimeheader runs endlessly for some inputs 1.9%
• CVE-2024-3096 Medium 6.5 PHP function password_verify can erroneously return true when argument contains NUL 1.5%
• CVE-2024-2756 Medium 6.5 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix 38.1%
• CVE-2023-3824 Critical 9.4 Buffer overflow and overread in phar_dir_read() 21.8%
• CVE-2023-3823 High 8.6 Security issue with external entity loading in XML without enabling it 1.6%
• CVE-2023-3247 Low 2.6 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP 0.7%
• CVE-2023-0568 High 7.5 Array overrun in common path resolve code 1.2%
• CVE-2023-0662 High 7.5 DoS vulnerability when parsing multipart request body 1.5%
• CVE-2023-0567 High 7.7 password_verify() always returns true for some invalid hashes 0.9%
• CVE-2022-31630 Medium 6.5 OOB read due to insufficient input validation in imageloadfont() 1.3%
• CVE-2022-31629 Medium 6.5 $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities 49.6%
• CVE-2022-31628 Low 2.3 phar wrapper can occur dos when using quine gzip file 0.6%
• CVE-2022-31627 High 7.7 Heap buffer overflow in finfo_buffer 2.1%
• CVE-2022-31626 High 7.5 mysqlnd/pdo password buffer overflow 58.1%
• CVE-2022-31625 High 8.1 Freeing unallocated memory in php_pgsql_free_params() 3.8%
• CVE-2021-21708 High 8.2 UAF due to php_filter_float() failing 3.0%
• CVE-2021-21707 Medium 5.3 Special characters break path parsing in XML functions 25.3%
• CVE-2021-21703 High 7.8 PHP-FPM memory access in root process leading to privilege escalation 1.4%
• CVE-2021-21706 Medium 5.3 ZipArchive::extractTo may extract outside of destination dir 1.5%
• CVE-2021-21705 Medium 4.3 Incorrect URL validation in FILTER_VALIDATE_URL 2.1%
• CVE-2021-21704 Medium 5.0 Multiple vulnerabilities in Firebird client extension 1.8%
• CVE-2021-21702 Medium 5.3 Null Dereference in SoapClient 3.2%
• CVE-2020-7071 Medium 5.3 FILTER_VALIDATE_URL accepts URLs with invalid userinfo 2.9%
• CVE-2020-7070 Medium 4.3 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent 5.0%
• CVE-2020-7069 Medium 5.4 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV 2.1%
• CVE-2020-7068 Medium 4.8 Use of freed hash key in the phar_parse_zipfile function 1.7%
• CVE-2020-7067 High 7.5 OOB Read in urldecode() 4.3%
• CVE-2020-7066 Medium 5.3 get_headers() silently truncates after a null byte 2.8%
• CVE-2020-7065 High 7.4 mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full 4.9%
• CVE-2020-7064 Medium 6.5 Use-of-uninitialized-value in exif 4.3%
• CVE-2020-7063 Medium 5.5 Files added to tar with Phar::buildFromIterator have all-access permissions 1.6%
• CVE-2020-7062 High 7.5 Null Pointer Dereference in PHP Session Upload Progress 3.6%
• CVE-2020-7061 Medium 6.5 heap-buffer-overflow in phar_extract_file 4.1%
• CVE-2020-7060 Medium 6.5 global buffer-overflow in mbfl_filt_conv_big5_wchar 8.9%
• CVE-2020-7059 Medium 6.5 OOB read in php_strip_tags_ex 7.4%