Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: PHP — GLSA-202012-16 Clear all filters
TI-2020-05709 CVE-2020-7070 · GHSA-j7r5-hm2w-qqf9

PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Priority LOW 32

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05029 Published 2020-10-02 Partial fix · 7.3.23, 7.4.11 +1 CWE-20
TI-2020-05708 CVE-2020-7069 · GHSA-v3rw-94vx-73w6

Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

Priority LOW 33

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01948 Published 2020-10-02 Partial fix · 7.3.23, 7.4.11 +1 CWE-20