Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: PHP 8.1.29, 8.2.20, 8.3.8 Clear all filters
TI-2024-02236 CVE-2024-2408

PHP is vulnerable to the Marvin Attack

Priority MEDIUM 60

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01158 Published 2024-06-09 Partial fix · 8.1.29, 8.2.20 +1 CWE-203
TI-2024-04260 CVE-2024-4577 · GHSA-vxpp-6299-mxw3

Argument Injection in PHP-CGI

Priority CRITICAL 100KEV

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace ch…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99987 Published 2024-06-09 Fixed in 8.1.29, 8.2.20 +1 CWE-78
TI-2024-05072 CVE-2024-5458

Filter bypass in filter_var (FILTER_VALIDATE_URL)

Priority MEDIUM 63

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the fun…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.12117 Published 2024-06-09 Partial fix · 8.1.29, 8.2.20 +1 CWE-345