Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: PHP — DSA-5277 Clear all filters
TI-2022-13553 CVE-2022-31629 · GHSA-c43m-486j-j32p

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Priority MEDIUM 60

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.49569 Published 2022-09-28 Partial fix · 7.4.31, 8.0.24 +1 CWE-20
TI-2022-13552 CVE-2022-31628 · GHSA-cj46-35hf-rv96

phar wrapper can occur dos when using quine gzip file

Priority LOW 26

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00628 Published 2022-09-28 Partial fix · 7.4.31, 8.0.24 +1 CWE-674