Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: PHP 8.0.28, 8.1.16, 8.2.3 Clear all filters
TI-2023-00539 CVE-2023-0568 · GHSA-6gqv-38q3-6c47

Array overrun in common path resolve code

Priority MEDIUM 40

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01242 Published 2023-02-16 Partial fix · 8.0.28, 8.1.16 +1 CWE-131
TI-2023-00627 CVE-2023-0662

DoS vulnerability when parsing multipart request body

Priority MEDIUM 42

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01469 Published 2023-02-16 Fixed in 8.0.28, 8.1.16 +1 CWE-400
TI-2023-00538 CVE-2023-0567

password_verify() always returns true for some invalid hashes

Priority LOW 39

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid.

CVSS 3.1HIGH 8.1 Adjacent network No auth No interaction EPSS 0.00925 Published 2023-02-16 Partial fix · 8.0.28, 8.1.16 +1 CWE-916