Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: PHP 8.1.28, 8.2.18, 8.3.5 Clear all filters
TI-2024-01743 CVE-2024-1874

Command injection via array-ish $command parameter of proc_open()

Priority HIGH 82

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a m…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.32799 Published 2024-04-29 Partial fix · 8.1.28, 8.2.18 +1 CWE-116
TI-2024-02900 CVE-2024-3096

PHP function password_verify can erroneously return true when argument contains NUL

Priority LOW 34

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will inc…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01492 Published 2024-04-29 Partial fix · 8.1.28, 8.2.18 +1 CWE-20
TI-2024-02567 CVE-2024-2756

__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Priority MEDIUM 62

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or _…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.38115 Published 2024-04-29 Partial fix · 8.1.28, 8.2.18 +1 CWE-20