Web application vulnerabilities
Showing 851 - 858 of 858 CVEs
- CVE-2001-0108 Published Mar 12, 2001
PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
- CVE-2001-1385 Published Jan 12, 2001
The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
- CVE-2000-0967 Published Dec 19, 2000
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
- CVE-2000-0860 Published Nov 14, 2000
The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables.
- CVE-2000-0059 Published Jan 4, 2000
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
- CVE-1999-0068 Published Oct 19, 1997
CGI PHP mylog script allows an attacker to read any file on the target server.
- CVE-1999-0238 Published Aug 1, 1997
php.cgi allows attackers to read any file on the system.
- CVE-1999-0058 Published Apr 17, 1997
Buffer overflow in PHP cgi program, php.cgi allows shell access.
PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables.
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
CGI PHP mylog script allows an attacker to read any file on the target server.
php.cgi allows attackers to read any file on the system.
Buffer overflow in PHP cgi program, php.cgi allows shell access.