CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 9491 | CVE-2004-1063 | Candidate | PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. | Assigned (20041123) | REVIEWING(1) Christey | Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability. | View |
| 9492 | CVE-2004-1064 | Candidate | The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. | Assigned (20041123) | REVIEWING(1) Christey | Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since various PHP functions already allow the application owner to | execute commands, no additional privileges would be gained by | exploiting such a bug. However, if safe_mode is enabled in PHP, then | the PHP functions related to execution are restricted | (e.g. shell_exec()). Thus, exploitation may allow the PHP application | owner to execute code *despite* the configured restrictions imposed by | safe mode, which then qualifies this as a vulnerability. | View |
| 10566 | CVE-2004-2140 | Candidate | CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable. | Assigned (20050630) | REVIEWING(1) Christey | Christey> likely dupe with CVE-2004-1982 | View |
| 10607 | CVE-2004-2181 | Candidate | Multiple SQL injection vulnerabilities in WowBB Forum 1.61 allow remote attackers to execute arbitrary SQL commands via the (1) sort_by or (2) page parameters to view_user.php, or the (3) forum_id parameter to view_topic.php. NOTE: the sort_by vector was later reported to be present in WowBB 1.65. | Assigned (20050711) | REVIEWING(1) Christey | Christey> The view_user.php/sort_by vector is covered by several CVEs. | Need to figure out how to handle this. | View |
| 10408 | CVE-2004-1982 | Candidate | Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board"s .txt file via carriage return characters in the subject field. | Assigned (20050504) | REVIEWING(1) Christey | Christey> likely dupe with CVE-2004-2140 | View |
Page 1 of 20943, showing 5 records out of 104715 total, starting on record 1, ending on 5
