PHP » PHP : Security Vulnerabilities (Bypass)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2018-10545	200	Bypass +Info	2018-04-29	2019-08-19	1.9	None	Local	Medium	Not required	Partial	None	None
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
2	CVE-2016-10397	20	Bypass	2017-07-10	2018-01-14	5.0	None	Remote	Low	Not required	None	Partial	None
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:[email protected]/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).
3	CVE-2015-4598	20	Bypass	2016-05-16	2019-04-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.
4	CVE-2015-4026	19	Bypass	2015-06-09	2019-04-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
5	CVE-2015-4025	19	Bypass	2015-06-09	2019-04-22	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
6	CVE-2015-3412	200	Bypass +Info	2016-05-16	2019-04-22	5.0	None	Remote	Low	Not required	Partial	None	None
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
7	CVE-2015-3411	20	Bypass	2016-05-16	2019-04-22	6.4	None	Remote	Low	Not required	Partial	Partial	None
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
8	CVE-2015-2348	264	Bypass	2015-03-30	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
9	CVE-2013-1635	264	Bypass	2013-03-06	2014-01-28	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
10	CVE-2012-4388	20	Http R.Spl. Bypass	2012-09-07	2023-02-13	4.3	None	Remote	Medium	Not required	None	Partial	None
The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
11	CVE-2012-3365	264	Bypass	2012-07-20	2017-12-01	5.0	None	Remote	Low	Not required	None	Partial	None
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
12	CVE-2012-2335	264	Exec Code Bypass	2012-05-11	2023-02-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
13	CVE-2012-1171	200	Bypass +Info	2014-02-15	2014-02-18	5.0	None	Remote	Low	Not required	Partial	None	None
The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.
14	CVE-2011-3189	310	Bypass	2011-08-25	2017-08-29	4.3	None	Remote	Medium	Not required	Partial	None	None
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
15	CVE-2011-1398	20	Http R.Spl. Bypass	2012-08-30	2013-10-11	4.3	None	Remote	Medium	Not required	None	Partial	None
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
16	CVE-2011-0752	20	Bypass	2011-02-02	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
17	CVE-2010-4699	189	Bypass	2011-01-18	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ks_c_5601-1987 character set.
18	CVE-2010-3870	20	Sql XSS Bypass	2010-11-12	2023-02-13	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
19	CVE-2010-3436	264	Bypass	2010-11-09	2022-09-01	5.0	None	Remote	Low	Not required	None	Partial	None
fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
20	CVE-2010-1866	189	DoS Overflow Mem. Corr. Bypass	2010-05-07	2010-09-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.
21	CVE-2010-1130	264	Bypass	2010-03-26	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
22	CVE-2010-1129	20	Bypass	2010-03-26	2010-08-31	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.
23	CVE-2009-5016	189	Overflow Sql XSS Bypass	2010-11-12	2018-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
24	CVE-2009-3558	264	Bypass	2009-11-23	2018-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file.
25	CVE-2009-3557	264	Bypass	2009-11-23	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments.
26	CVE-2008-7002	264	Bypass	2009-08-19	2009-08-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.
27	CVE-2008-5624	264	Bypass	2008-12-17	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
28	CVE-2008-2666	22	Dir. Trav. Bypass	2008-06-20	2018-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
29	CVE-2008-2665	22	Dir. Trav. Bypass	2008-06-20	2018-10-11	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in the posix_access function in PHP 5.2.6 and earlier allows remote attackers to bypass safe_mode restrictions via a .. (dot dot) in an http URL, which results in the URL being canonicalized to a local filename after the safe_mode check has successfully run.
30	CVE-2008-2107	189	Bypass	2008-05-07	2018-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mt_rand functions and possibly bypass protection mechanisms that rely on an unknown initial seed.
31	CVE-2007-5900	264	Bypass	2007-11-20	2018-10-15	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
32	CVE-2007-5653	78	Bypass	2007-10-23	2017-09-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function.
33	CVE-2007-5447	264	Bypass	2007-10-14	2017-09-29	4.3	None	Remote	Medium	Not required	Partial	None	None
ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.
34	CVE-2007-5424		Bypass	2007-10-12	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The disable_functions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using ini_alter when ini_set is disabled.
35	CVE-2007-4889		Bypass	2007-09-14	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe_mode and open_basedir restrictions via the MySQL (1) LOAD_FILE, (2) INTO DUMPFILE, and (3) INTO OUTFILE functions, a different issue than CVE-2007-3997.
36	CVE-2007-4850	264	Bypass	2008-01-25	2018-10-15	5.0	None	Remote	Low	Not required	Partial	None	None
curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.
37	CVE-2007-4825	22	Exec Code Dir. Trav. Bypass	2007-09-12	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl function.
38	CVE-2007-4663	22	Dir. Trav. Bypass	2007-09-04	2017-07-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in PHP before 5.2.4 allows attackers to bypass open_basedir restrictions via unspecified vectors involving the glob function.
39	CVE-2007-4652	59	Bypass	2007-09-04	2017-07-29	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.
40	CVE-2007-3997	264	Bypass	2007-09-04	2018-10-26	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.
41	CVE-2007-3378	264	Exec Code Bypass	2007-06-29	2020-09-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.
42	CVE-2007-1884		Exec Code Bypass	2007-04-06	2018-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple integer signedness errors in the printf function family in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on 64 bit machines allow context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers that arise in the php_formatted_print function because of 64 to 32 bit truncation, and bypass a check for the maximum allowable value; and (2) a width and precision of -1, which make it possible for the php_sprintf_appendstring function to place an internal buffer at an arbitrary memory location.
43	CVE-2007-1835		Bypass	2007-04-03	2018-10-30	4.6	None	Local	Low	Not required	Partial	Partial	Partial
PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions.
44	CVE-2007-1710		Bypass	2007-03-27	2017-10-11	4.3	None	Local	Low	???	Partial	Partial	Partial
The readfile function in PHP 4.4.4, 5.1.6, and 5.2.1 allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files by referring to local files with a certain URL syntax instead of a pathname syntax, as demonstrated by a filename preceded a "php://../../" sequence.
45	CVE-2007-1584		Exec Code Bypass	2007-03-21	2017-10-11	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by passing an all-whitespace string to this function, which causes it to write '\0' characters in whitespace that precedes the string.
46	CVE-2007-1484		Exec Code Mem. Corr. Bypass	2007-03-16	2018-10-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.
47	CVE-2007-1452		Bypass	2007-03-14	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attackers to bypass web site filters via an application/vnd.fdf formatted POST.
48	CVE-2007-0905		Bypass	2007-02-13	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
49	CVE-2007-0448		Bypass	2007-05-24	2008-09-11	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.
50	CVE-2006-7243	20	Bypass	2011-01-18	2018-10-30	5.0	None	Remote	Low	Not required	None	Partial	None
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

Total number of vulnerabilities : 72 Page : 1 (This Page)2