47.108.118.92

Regular View Raw Data

GeneralInformation

Country China
City Chengdu
Organization Aliyun Computing Co., LTD
ISP Hangzhou Alibaba Advertising Co.,Ltd.
ASN AS37963

Vulnerabilities

Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.

OpenPorts

1113151719212223252637434953707980818283848588100102104110111113119143161175179195221264311340389427443444450465502503515548554587631636666771789873902992993995102210231024109911531200123413111337140014331471152115541599160416601723174118011883191119251926193519622000200220082020202120522059206620672079208120822083208620872095211121212126215021542181222222902323233223452375237623792404245524802554262827612762300030013050305330573063306830963103311631213211322132603268326932993301330633103388338934063408354135423551368937493780379038383952400040224040406340644100420042424282432143694433444344494450445145004505450645454550456746464664478247864808484048484899491149495000500150055006500750095010502550505172520152225269532153575432543555605601580158585900590159385984598559866000600160026036608063086379644365886633665366646666666766686697700170717080717172187401743474437474753775477548763476577777777979898000800180088009801080178022803680568060806680698080808180828086808780888089809080938098809981008109811281238126813981408181818482008249829183338334840684108411841884218427842884438500854585548575862286498686872887908800880788108812881488248827883488448869888088888889889089919000900190029009901090139042905190809090909190929093909591009103911191519160919192009203920592139216922292959302930693099389941894439530959596009761980098699876994399449981999899991000010001102431025010443105541090910911110001111211210112111130011371114341200012345135791414714265160101603016992170001808118245190001907120000202562054721025213792302323424250012510525565270152801528017280803000230003313373240032764330603500037215377774180044158448184799049152491535000050050500705010051106512355286953413541385500055442554435555355554600016001060030616136161662078
-2031469209 | 2024-06-10T07:08:48.180434
  
11 / tcp
-2031469209 | 2024-06-10T11:16:26.993026
  
13 / tcp
-2031469209 | 2024-06-10T03:52:30.161344
  
15 / tcp
-2031469209 | 2024-06-10T09:55:07.236599
  
17 / tcp
-98713449 | 2024-06-10T12:38:28.804747
  
19 / tcp
-1063174948 | 2024-06-10T12:35:02.849695
  
21 / tcp
1754772078 | 2024-06-10T10:23:53.060922
  
22 / tcp
1751235923 | 2024-06-10T06:32:15.127892
  
23 / tcp
786525225 | 2024-06-10T02:33:49.934333
  
25 / tcp
1738565259 | 2024-06-10T10:51:10.239780
  
26 / tcp
-98713449 | 2024-06-10T12:57:58.220859
  
37 / tcp
-2031469209 | 2024-06-10T10:24:36.087265
  
43 / tcp
-98713449 | 2024-06-10T03:12:57.323291
  
49 / tcp
-2031469209 | 2024-06-10T09:20:25.243478
  
53 / tcp
-2031469209 | 2024-06-10T10:57:04.201624
  
70 / tcp
-2031469209 | 2024-06-10T04:42:52.395516
  
79 / tcp
1793581629 | 2024-06-10T08:05:12.751116
  
80 / tcp
-1805871619 | 2024-06-10T08:04:27.323088
  
81 / tcp
-1820446516 | 2024-06-10T10:45:35.024273
  
82 / tcp
-1820446516 | 2024-06-10T09:59:56.673616
  
83 / tcp
633775022 | 2024-06-10T09:41:17.462640
  
84 / tcp
-1805871619 | 2024-05-18T14:24:49.671575
  
85 / tcp
-488469797 | 2024-06-10T08:30:24.065992
  
88 / tcp
-2031469209 | 2024-05-20T19:02:57.227854
  
100 / tcp
-1091575315 | 2024-06-10T11:20:08.665219
  
102 / tcp
-2031469209 | 2024-06-10T12:03:44.764296
  
104 / tcp
-776469200 | 2024-06-10T10:28:11.797159
  
110 / tcp
-2031469209 | 2024-06-10T10:51:04.044079
  
111 / tcp
-2031469209 | 2024-06-10T03:26:31.001928
  
113 / tcp
-98713449 | 2024-06-10T10:11:26.769998
  
119 / tcp
-1687578356 | 2024-06-10T07:44:11.773311
  
143 / tcp
-289893565 | 2024-06-10T10:16:19.289750
  
161 / udp
-98713449 | 2024-06-10T10:22:13.850006
  
175 / tcp
-2031469209 | 2024-06-10T01:36:02.912156
  
179 / tcp
-2031469209 | 2024-06-10T05:05:48.435776
  
195 / tcp
-98713449 | 2024-06-10T09:19:45.734746
  
221 / tcp
-98713449 | 2024-06-10T12:05:34.634022
  
264 / tcp
411540654 | 2024-06-10T12:56:49.065558
  
311 / tcp
-98713449 | 2024-05-30T04:20:04.417012
  
340 / tcp
-2031469209 | 2024-06-10T12:44:14.078052
  
389 / tcp
-1453395553 | 2024-06-10T08:23:23.289645
  
427 / tcp
864306896 | 2024-06-10T07:14:18.264361
  
443 / tcp
-771463154 | 2024-06-10T09:18:31.464739
  
444 / tcp
-2031469209 | 2024-05-20T05:45:53.509856
  
450 / tcp
-2031469209 | 2024-06-10T03:12:59.297519
  
465 / tcp
-236382233 | 2024-06-10T10:34:04.539701
  
502 / tcp
-2031469209 | 2024-06-10T11:39:04.050327
  
503 / tcp
-2031469209 | 2024-06-10T10:09:30.762946
  
515 / tcp
-2031469209 | 2024-06-10T03:07:12.958955
  
548 / tcp
-2031469209 | 2024-06-10T02:25:28.147705
  
554 / tcp
-98713449 | 2024-06-10T12:35:55.047020
  
587 / tcp
998037014 | 2024-06-10T09:04:36.015808
  
631 / tcp
998037014 | 2024-06-10T11:43:03.717117
  
636 / tcp
-2031469209 | 2024-06-09T23:37:32.018086
  
666 / tcp
-2031469209 | 2024-06-10T10:42:28.544348
  
771 / tcp
-2031469209 | 2024-06-10T08:22:46.038880
  
789 / tcp
-98713449 | 2024-06-10T08:51:17.843419
  
873 / tcp
-2031469209 | 2024-06-10T05:24:41.737358
  
902 / tcp
-2031469209 | 2024-06-10T10:50:11.399090
  
992 / tcp
-98713449 | 2024-06-10T11:07:03.356050
  
993 / tcp
-2031469209 | 2024-06-10T10:03:04.135190
  
995 / tcp
-98713449 | 2024-05-24T19:23:08.127209
  
1022 / tcp
-2126306123 | 2024-06-10T03:05:01.755659
  
1023 / tcp
-2031469209 | 2024-06-10T04:17:10.530584
  
1024 / tcp
1719991439 | 2024-06-10T05:47:18.106580
  
1099 / tcp
-2031469209 | 2024-06-10T12:06:21.189304
  
1153 / tcp
-2031469209 | 2024-06-10T06:47:48.870058
  
1200 / tcp
-1198227559 | 2024-06-10T12:23:14.584364
  
1234 / tcp
-2031469209 | 2024-06-09T22:37:44.881952
  
1311 / tcp
-1823563380 | 2024-06-10T06:52:31.180596
  
1337 / tcp
-98713449 | 2024-06-10T08:22:55.721697
  
1400 / tcp
1339473574 | 2024-06-10T12:17:16.862653
  
1433 / tcp
-2031469209 | 2024-06-10T06:28:36.288298
  
1471 / tcp
-2031469209 | 2024-06-10T09:50:00.067170
  
1521 / tcp
-98713449 | 2024-05-13T17:08:30.633195
  
1554 / tcp
-2031469209 | 2024-06-10T12:06:50.245366
  
1599 / tcp
-2031469209 | 2024-06-10T11:53:18.227024
  
1604 / tcp
-98713449 | 2024-05-27T21:00:58.017688
  
1660 / tcp
-2031469209 | 2024-06-10T04:40:36.716382
  
1723 / tcp
-98713449 | 2024-06-10T08:36:34.282337
  
1741 / tcp
-2031469209 | 2024-06-10T07:33:01.411410
  
1883 / tcp
-2031469209 | 2024-06-10T04:03:02.242750
  
1911 / tcp
-2031469209 | 2024-06-10T07:26:41.164631
  
1925 / tcp
411540654 | 2024-06-10T07:36:19.823230
  
1926 / tcp
-2031469209 | 2024-06-10T04:01:41.616980
  
1935 / tcp
-98713449 | 2024-06-10T02:44:40.540992
  
1962 / tcp
-98713449 | 2024-06-09T21:00:07.102016
  
2000 / tcp
-98713449 | 2024-06-10T10:27:37.432591
  
2002 / tcp
-98713449 | 2024-05-24T16:56:59.415660
  
2008 / tcp
-2031469209 | 2024-06-07T15:47:56.189845
  
2020 / tcp
-98713449 | 2024-05-15T19:50:46.119672
  
2021 / tcp
-2031469209 | 2024-06-07T20:51:30.099572
  
2052 / tcp
-98713449 | 2024-05-18T06:27:07.092286
  
2059 / tcp
-98713449 | 2024-05-27T13:53:47.530125
  
2066 / tcp
-2031469209 | 2024-06-10T11:52:14.403503
  
2067 / tcp
-98713449 | 2024-05-29T22:53:52.455194
  
2079 / tcp
-2031469209 | 2024-06-09T21:03:38.419312
  
2081 / tcp
-2031469209 | 2024-06-10T10:12:36.959825
  
2082 / tcp
1094048410 | 2024-06-10T12:06:44.141264
  
2083 / tcp
-1475755397 | 2024-06-10T01:57:10.693154
  
2086 / tcp
-1475755397 | 2024-06-10T07:28:52.358083
  
2087 / tcp
-98713449 | 2024-05-15T07:43:01.683332
  
2095 / tcp
-98713449 | 2024-06-01T16:27:52.328938
  
2111 / tcp
-98713449 | 2024-06-10T10:48:43.192792
  
2121 / tcp
-98713449 | 2024-05-27T03:35:26.025797
  
2126 / tcp
-98713449 | 2024-05-16T07:21:09.188995
  
2150 / tcp
-98713449 | 2024-06-10T10:59:24.543434
  
2154 / tcp
-2031469209 | 2024-06-10T10:24:00.843628
  
2181 / tcp
-692131318 | 2024-06-10T11:35:10.617466
  
2222 / tcp
-98713449 | 2024-05-16T12:21:55.560799
  
2290 / tcp
1453710100 | 2024-06-10T10:39:55.288050
  
2323 / tcp
-98713449 | 2024-06-10T08:53:31.285650
  
2332 / tcp
-2031469209 | 2024-06-10T10:31:50.109144
  
2345 / tcp
-2031469209 | 2024-06-10T06:40:56.160492
  
2375 / tcp
1094048410 | 2024-06-10T10:04:25.179372
  
2376 / tcp
-2031469209 | 2024-06-10T09:46:20.054969
  
2379 / tcp
-1863726365 | 2024-06-10T12:49:30.614223
  
2404 / tcp
-2031469209 | 2024-06-10T06:41:19.041472
  
2455 / tcp
1500500966 | 2024-05-16T09:57:33.087933
  
2480 / tcp
-2031469209 | 2024-06-07T01:10:53.145469
  
2554 / tcp
-2031469209 | 2024-05-21T15:15:56.841929
  
2628 / tcp
-98713449 | 2024-06-10T07:49:51.615955
  
2761 / tcp
-2031469209 | 2024-06-10T08:32:04.032848
  
2762 / tcp
-291974457 | 2024-06-10T12:53:23.351505
  
3000 / tcp
-98713449 | 2024-06-10T05:45:29.169940
  
3001 / tcp
-2031469209 | 2024-06-10T11:44:24.310118
  
3050 / tcp
-2031469209 | 2024-06-08T11:42:43.740037
  
3053 / tcp
-98713449 | 2024-05-18T20:31:17.458950
  
3057 / tcp
-98713449 | 2024-05-13T00:28:28.133724
  
3063 / tcp
-2031469209 | 2024-06-06T19:22:37.833581
  
3068 / tcp
-98713449 | 2024-05-23T23:01:33.971791
  
3096 / tcp
-2031469209 | 2024-05-13T20:58:18.692460
  
3103 / tcp
-2031469209 | 2024-06-06T23:53:52.714967
  
3116 / tcp
-2031469209 | 2024-06-09T02:18:26.027197
  
3121 / tcp
-2031469209 | 2024-06-02T09:53:54.873262
  
3211 / tcp
-98713449 | 2024-05-12T21:12:12.715689
  
3221 / tcp
-2031469209 | 2024-06-10T12:15:09.467035
  
3260 / tcp
-2031469209 | 2024-06-10T12:09:54.426276
  
3268 / tcp
-2031469209 | 2024-06-10T06:59:10.124100
  
3269 / tcp
-98713449 | 2024-06-10T10:58:33.211796
  
3299 / tcp
-2031469209 | 2024-06-10T04:23:56.636298
  
3301 / tcp
-740155298 | 2024-06-10T08:56:48.661577
  
3306 / tcp
-98713449 | 2024-06-10T09:09:59.953968
  
3310 / tcp
-98713449 | 2024-06-10T01:59:50.632658
  
3388 / tcp
-681648404 | 2024-06-09T22:59:25.111150
  
3389 / tcp
-98713449 | 2024-06-08T03:23:22.504092
  
3406 / tcp
-98713449 | 2024-05-20T18:29:50.323931
  
3408 / tcp
-2031469209 | 2024-06-10T08:03:22.468572
  
3541 / tcp
-2031469209 | 2024-06-10T11:02:51.072150
  
3542 / tcp
-2031469209 | 2024-06-10T12:31:26.766748
  
3551 / tcp
-2031469209 | 2024-06-10T11:04:51.693705
  
3689 / tcp
-2031469209 | 2024-06-10T12:26:22.764797
  
3749 / tcp
1094048410 | 2024-06-10T12:40:32.575250
  
3780 / tcp
411540654 | 2024-06-10T11:41:54.395886
  
3790 / tcp
-2031469209 | 2024-05-18T12:22:33.521968
  
3838 / tcp
-2031469209 | 2024-06-06T21:24:00.017319
  
3952 / tcp
-98713449 | 2024-06-10T06:53:06.856820
  
4000 / tcp
-597069886 | 2024-06-10T06:08:22.796181
  
4022 / tcp
-98713449 | 2024-06-10T03:20:08.503970
  
4040 / tcp
-2031469209 | 2024-06-10T07:43:13.152676
  
4063 / tcp
-2031469209 | 2024-06-10T11:40:22.423642
  
4064 / tcp
-2031469209 | 2024-05-27T20:04:55.521562
  
4100 / tcp
-98713449 | 2024-05-16T23:59:55.925881
  
4200 / tcp
-348935644 | 2024-06-10T03:35:36.763332
  
4242 / tcp
-98713449 | 2024-05-26T04:46:25.557536
  
4282 / tcp
-98713449 | 2024-06-10T12:45:13.396547
  
4321 / tcp
-2031469209 | 2024-06-10T06:29:24.910787
  
4369 / tcp
-756278524 | 2024-06-10T00:54:22.779277
  
4433 / tcp
-793426659 | 2024-06-10T06:59:06.965541
  
4443 / tcp
-98713449 | 2024-05-16T14:19:22.650386
  
4449 / tcp
-98713449 | 2024-05-16T13:07:31.691696
  
4450 / tcp
-98713449 | 2024-05-16T10:48:56.248528
  
4451 / tcp
-2031469209 | 2024-06-10T12:27:03.533755
  
4500 / tcp
-98713449 | 2024-05-12T13:37:43.695371
  
4505 / tcp
-2031469209 | 2024-06-10T04:31:37.886596
  
4506 / tcp
-2031469209 | 2024-06-07T20:33:06.787592
  
4545 / tcp
-98713449 | 2024-05-18T19:16:23.483977
  
4550 / tcp
-2031469209 | 2024-06-10T10:54:09.864993
  
4567 / tcp
-98713449 | 2024-05-24T21:33:42.231371
  
4646 / tcp
-2031469209 | 2024-06-10T10:11:22.695020
  
4664 / tcp
-2031469209 | 2024-06-10T12:50:17.853117
  
4782 / tcp
-1478571435 | 2024-06-10T12:28:18.608336
  
4786 / tcp
-2031469209 | 2024-06-10T06:13:47.106851
  
4808 / tcp
-2031469209 | 2024-06-09T22:39:41.872351
  
4840 / tcp
-98713449 | 2024-06-10T06:26:08.538463
  
4848 / tcp
-2031469209 | 2024-06-10T12:51:40.491788
  
4899 / tcp
-98713449 | 2024-06-10T12:55:48.138242
  
4911 / tcp
-2031469209 | 2024-06-10T12:23:30.025627
  
4949 / tcp
1561587376 | 2024-06-10T08:58:41.641141
  
5000 / tcp
-1514911176 | 2024-05-16T15:37:27.845990
  
5001 / tcp
-2031469209 | 2024-06-10T11:34:23.264148
  
5005 / tcp
1094048410 | 2024-06-09T23:20:22.289743
  
5006 / tcp
-98713449 | 2024-06-10T09:08:56.250976
  
5007 / tcp
-2031469209 | 2024-06-10T03:47:26.949501
  
5009 / tcp
-2031469209 | 2024-06-10T12:10:50.728726
  
5010 / tcp
-98713449 | 2024-06-10T08:47:13.573147
  
5025 / tcp
-2031469209 | 2024-06-06T23:41:59.069442
  
5050 / tcp
1094048410 | 2024-06-10T07:22:02.371047
  
5172 / tcp
-2031469209 | 2024-06-10T10:48:55.739936
  
5201 / tcp
-98713449 | 2024-06-10T04:54:47.631682
  
5222 / tcp
-2031469209 | 2024-06-10T10:58:28.413818
  
5269 / tcp
-98713449 | 2024-05-11T21:55:04.203345
  
5321 / tcp
-2031469209 | 2024-06-10T12:58:17.428293
  
5357 / tcp
-726790289 | 2024-06-10T04:36:48.987210
  
5432 / tcp
-2031469209 | 2024-06-10T04:28:26.223334
  
5435 / tcp
-2031469209 | 2024-06-10T11:18:33.264299
  
5560 / tcp
997310454 | 2024-06-10T10:47:39.846923
  
5601 / tcp
-2031469209 | 2024-06-10T02:48:01.057774
  
5801 / tcp
-2031469209 | 2024-06-10T03:00:36.472805
  
5858 / tcp
497968563 | 2024-06-10T11:22:10.323327
  
5900 / tcp
-2031469209 | 2024-06-10T10:35:37.014228
  
5901 / tcp
-2031469209 | 2024-06-10T10:59:23.547514
  
5938 / tcp
-453886593 | 2024-06-10T11:16:37.567562
  
5984 / tcp
-427937664 | 2024-06-10T12:27:39.907242
  
5985 / tcp
310066493 | 2024-06-10T10:33:20.689814
  
5986 / tcp
-2031469209 | 2024-06-10T10:08:55.948569
  
6000 / tcp
-98713449 | 2024-06-10T05:55:21.605497
  
6001 / tcp
-98713449 | 2024-06-10T07:36:10.504033
  
6002 / tcp
-98713449 | 2024-05-25T21:19:53.231687
  
6036 / tcp
-2031469209 | 2024-06-10T12:42:48.179501
  
6080 / tcp
-2031469209 | 2024-06-07T21:11:53.953893
  
6308 / tcp
-1963419546 | 2024-06-10T09:12:01.785352
  
6379 / tcp
411540654 | 2024-06-10T06:46:30.409585
  
6443 / tcp
-98713449 | 2024-05-27T14:30:53.503017
  
6588 / tcp
-98713449 | 2024-06-10T12:26:07.119504
  
6633 / tcp
-98713449 | 2024-06-10T11:46:02.256837
  
6653 / tcp
-98713449 | 2024-06-10T09:47:06.600025
  
6664 / tcp
-2031469209 | 2024-06-10T12:36:47.792541
  
6666 / tcp
-2031469209 | 2024-06-10T09:42:47.656943
  
6667 / tcp
-2031469209 | 2024-06-10T03:29:47.896435
  
6668 / tcp
-2031469209 | 2024-06-10T04:42:10.074402
  
6697 / tcp
-1514911176 | 2024-06-10T07:14:59.885168
  
7001 / tcp
1094048410 | 2024-06-10T09:29:40.536748
  
7071 / tcp
-98713449 | 2024-05-17T21:14:01.896907
  
7080 / tcp
-2031469209 | 2024-06-10T11:43:44.128682
  
7171 / tcp
-98713449 | 2024-06-10T04:52:04.664187
  
7218 / tcp
-98713449 | 2024-05-14T20:58:44.820973
  
7401 / tcp
411540654 | 2024-05-29T19:47:52.402330
  
7434 / tcp
1094048410 | 2024-06-10T12:47:52.905973
  
7443 / tcp
2105495716 | 2024-06-10T09:12:33.899547
  
7474 / tcp
-98713449 | 2024-05-15T20:52:18.144736
  
7537 / tcp
430537855 | 2024-06-10T13:12:45.176632
  
7547 / tcp
1094048410 | 2024-06-10T05:40:14.723851
  
7548 / tcp
-2031469209 | 2024-06-10T03:34:34.868691
  
7634 / tcp
-2031469209 | 2024-06-10T09:25:36.510673
  
7657 / tcp
-98713449 | 2024-06-10T12:08:51.142790
  
7777 / tcp
-2031469209 | 2024-06-10T09:50:12.429105
  
7779 / tcp
-98713449 | 2024-06-10T09:09:52.015190
  
7989 / tcp
1832614531 | 2024-06-10T10:56:03.863198
  
8000 / tcp
-1820446516 | 2024-06-10T11:36:19.238775
  
8001 / tcp
-1820446516 | 2024-06-10T04:26:43.579550
  
8008 / tcp
-1820446516 | 2024-06-10T12:55:48.566659
  
8009 / tcp
-1820446516 | 2024-06-10T11:19:12.323687
  
8010 / tcp
-2031469209 | 2024-05-28T18:03:08.364343
  
8017 / tcp
1320195901 | 2024-05-26T13:42:45.220399
  
8022 / tcp
-98713449 | 2024-05-30T22:54:14.931179
  
8036 / tcp
-98713449 | 2024-05-13T05:45:58.674053
  
8056 / tcp
-2031469209 | 2024-06-10T04:36:21.353396
  
8060 / tcp
-98713449 | 2024-05-27T12:07:49.770554
  
8066 / tcp
-2031469209 | 2024-06-10T09:25:46.454306
  
8069 / tcp
1793581629 | 2024-06-09T23:09:33.013959
  
8080 / tcp
1610587394 | 2024-06-09T20:58:22.903511
  
8081 / tcp
1638073473 | 2024-05-14T00:12:02.283376
  
8082 / tcp
-1820446516 | 2024-06-10T09:27:38.740095
  
8086 / tcp
1676912939 | 2024-05-21T06:49:55.871344
  
8088 / tcp
1225987819 | 2024-06-10T12:32:50.094194
  
8089 / tcp
1685468267 | 2024-06-10T11:18:25.044575
  
8090 / tcp
1727435794 | 2024-06-09T09:09:17.791260
  
8093 / tcp
-2031469209 | 2024-06-10T12:00:44.400992
  
8098 / tcp
-879241106 | 2024-06-10T08:55:26.128392
  
8099 / tcp
-98713449 | 2024-05-26T00:40:08.293465
  
8100 / tcp
-98713449 | 2024-05-25T19:01:06.502437
  
8109 / tcp
-2031469209 | 2024-06-10T12:44:57.488372
  
8112 / tcp
-98713449 | 2024-06-10T06:27:53.803441
  
8123 / tcp
-2031469209 | 2024-06-10T11:08:11.723552
  
8126 / tcp
1094048410 | 2024-06-10T02:28:44.293614
  
8139 / tcp
1094048410 | 2024-06-10T10:18:58.668668
  
8140 / tcp
64480701 | 2024-06-10T04:51:12.955666
  
8181 / tcp
-98713449 | 2024-05-15T03:38:57.652331
  
8184 / tcp
-2031469209 | 2024-06-10T12:41:56.246864
  
8200 / tcp
-98713449 | 2024-05-31T00:29:46.833499
  
8249 / tcp
1191162421 | 2024-06-10T10:26:58.297676
  
8291 / tcp
-98713449 | 2024-06-10T07:52:12.268831
  
8333 / tcp
-2031469209 | 2024-06-10T08:44:39.773346
  
8334 / tcp
-2031469209 | 2024-06-10T08:37:11.757509
  
8406 / tcp
-98713449 | 2024-05-18T17:07:40.499344
  
8410 / tcp
-98713449 | 2024-05-17T19:39:51.889422
  
8411 / tcp
-98713449 | 2024-05-31T10:29:55.112659
  
8418 / tcp
-98713449 | 2024-05-20T20:18:06.530520
  
8421 / tcp
-2031469209 | 2024-05-30T22:13:52.871423
  
8427 / tcp
-98713449 | 2024-05-30T18:19:42.405908
  
8428 / tcp
-2100871842 | 2024-06-10T07:26:35.242583
  
8443 / tcp
411540654 | 2024-06-10T11:46:43.512207
  
8500 / tcp
-1341732464 | 2024-06-10T06:36:23.212197
  
8545 / tcp
-2031469209 | 2024-06-10T10:00:27.833943
  
8554 / tcp
-2031469209 | 2024-06-10T12:32:30.719870
  
8575 / tcp
-98713449 | 2024-05-15T16:34:27.032184
  
8622 / tcp
-2031469209 | 2024-06-10T04:18:26.841926
  
8649 / tcp
-1058385585 | 2024-05-23T13:47:07.357666
  
8686 / tcp
-98713449 | 2024-05-21T22:38:36.109685
  
8790 / tcp
-2031469209 | 2024-06-10T10:37:46.763931
  
8800 / tcp
-98713449 | 2024-05-29T16:21:30.609419
  
8807 / tcp
-98713449 | 2024-05-31T11:38:06.044830
  
8812 / tcp
-98713449 | 2024-05-18T00:22:55.674556
  
8814 / tcp
-98713449 | 2024-06-06T16:01:33.309416
  
8824 / tcp
-2031469209 | 2024-05-29T20:43:14.870589
  
8827 / tcp
1094048410 | 2024-06-10T10:35:26.252309
  
8834 / tcp
-98713449 | 2024-05-17T10:30:20.088679
  
8844 / tcp
-98713449 | 2024-05-31T21:07:17.524533
  
8869 / tcp
411540654 | 2024-06-10T05:33:10.583103
  
8880 / tcp
1832614531 | 2024-06-10T07:51:42.559137
  
8888 / tcp
1094048410 | 2024-06-10T00:14:24.893766
  
8889 / tcp
-98713449 | 2024-05-16T01:37:46.122330
  
8890 / tcp
-98713449 | 2024-05-30T12:21:15.491387
  
8991 / tcp
1347224596 | 2024-06-10T10:19:59.838426
  
9000 / tcp
1634741987 | 2024-06-10T06:35:49.531760
  
9001 / tcp
1094048410 | 2024-06-10T10:03:38.034136
  
9002 / tcp
-2031469209 | 2024-06-10T09:29:33.760058
  
9009 / tcp
-98713449 | 2024-05-23T06:00:52.675087
  
9010 / tcp
-98713449 | 2024-06-09T23:06:28.956496
  
9013 / tcp
-98713449 | 2024-06-10T05:23:10.466762
  
9042 / tcp
-98713449 | 2024-06-10T06:15:18.278352
  
9051 / tcp
-2113003112 | 2024-06-10T10:08:37.583179
  
9080 / tcp
2005929508 | 2024-06-10T06:45:11.962105
  
9090 / tcp
411540654 | 2024-06-10T12:24:15.175821
  
9091 / tcp
-98713449 | 2024-06-07T01:38:01.706379
  
9092 / tcp
-98713449 | 2024-06-09T23:37:29.568414
  
9093 / tcp
411540654 | 2024-05-21T08:44:03.660910
  
9095 / tcp
-2031469209 | 2024-06-10T07:11:09.240649
  
9100 / tcp
-2031469209 | 2024-06-06T19:35:13.090006
  
9103 / tcp
-2031469209 | 2024-06-01T10:42:17.230876
  
9111 / tcp
-2031469209 | 2024-06-09T21:15:36.912155
  
9151 / tcp
-2031469209 | 2024-06-10T00:00:30.142459
  
9160 / tcp
521951111 | 2024-06-10T11:57:50.198372
  
9191 / tcp
1701962934 | 2024-06-10T07:19:25.317837
  
9200 / tcp
-98713449 | 2024-05-26T22:31:23.131536
  
9203 / tcp
-98713449 | 2024-05-14T07:08:59.199214
  
9205 / tcp
-98713449 | 2024-05-28T22:06:49.939130
  
9213 / tcp
-98713449 | 2024-05-28T19:29:54.860219
  
9216 / tcp
-2031469209 | 2024-05-25T13:46:18.916677
  
9222 / tcp
-2031469209 | 2024-06-10T11:10:22.422396
  
9295 / tcp
-98713449 | 2024-05-29T23:14:24.898638
  
9302 / tcp
1094048410 | 2024-06-10T05:44:06.545967
  
9306 / tcp
-98713449 | 2024-05-16T09:20:00.175884
  
9309 / tcp
-98713449 | 2024-05-27T12:14:06.628631
  
9389 / tcp
-2031469209 | 2024-06-10T10:52:43.002976
  
9418 / tcp
864306896 | 2024-06-10T11:15:41.250952
  
9443 / tcp
-2031469209 | 2024-06-10T06:25:56.945647
  
9530 / tcp
-2031469209 | 2024-06-10T09:39:23.533527
  
9595 / tcp
-98713449 | 2024-06-10T01:57:24.256244
  
9600 / tcp
-2031469209 | 2024-06-10T11:26:39.465318
  
9761 / tcp
-2031469209 | 2024-06-10T09:56:14.115463
  
9800 / tcp
-98713449 | 2024-06-10T03:11:04.135086
  
9869 / tcp
-98713449 | 2024-05-25T01:23:52.628715
  
9876 / tcp
1094048410 | 2024-06-10T11:35:25.450633
  
9943 / tcp
-2031469209 | 2024-06-10T08:20:34.160967
  
9944 / tcp
-2031469209 | 2024-06-10T01:42:47.772391
  
9981 / tcp
-2031469209 | 2024-06-10T09:14:28.156039
  
9998 / tcp
908330337 | 2024-06-10T07:57:13.861672
  
9999 / tcp
-1640897494 | 2024-06-10T10:28:04.402387
  
10000 / tcp
-98713449 | 2024-06-10T11:16:35.244340
  
10001 / tcp
-2031469209 | 2024-06-10T11:17:01.433945
  
10243 / tcp
1094048410 | 2024-06-10T06:51:11.541268
  
10250 / tcp
1793581629 | 2024-06-10T03:48:45.505583
  
10443 / tcp
-2031469209 | 2024-06-10T08:16:40.943555
  
10554 / tcp
-2031469209 | 2024-06-10T01:48:34.200617
  
10909 / tcp
-2031469209 | 2024-05-28T01:07:07.031700
  
10911 / tcp
-2031469209 | 2024-06-10T04:11:28.437807
  
11000 / tcp
-98713449 | 2024-06-10T13:08:50.101165
  
11112 / tcp
-2031469209 | 2024-06-10T11:45:58.046546
  
11210 / tcp
2034197593 | 2024-06-10T05:57:42.841578
  
11211 / tcp
-98713449 | 2024-06-10T09:08:33.140445
  
11300 / tcp
-2031469209 | 2024-06-10T09:16:59.420723
  
11371 / tcp
-2031469209 | 2024-06-10T07:47:30.253281
  
11434 / tcp
-2031469209 | 2024-06-10T05:42:51.218923
  
12000 / tcp
-2031469209 | 2024-06-10T09:14:42.740526
  
13579 / tcp
-98713449 | 2024-06-10T05:07:24.379567
  
14147 / tcp
-2031469209 | 2024-06-10T06:55:55.529451
  
14265 / tcp
-98713449 | 2024-05-16T03:58:20.246885
  
16010 / tcp
-98713449 | 2024-05-22T09:10:10.451085
  
16030 / tcp
998037014 | 2024-06-10T11:09:30.809613
  
16992 / tcp
-2031469209 | 2024-06-10T11:06:01.431408
  
17000 / tcp
1859111832 | 2024-06-10T12:15:06.425784
  
18081 / tcp
-2031469209 | 2024-06-10T07:14:04.454470
  
18245 / tcp
-2031469209 | 2024-06-10T03:33:45.704615
  
19000 / tcp
-2031469209 | 2024-06-10T10:47:42.759961
  
19071 / tcp
-2031469209 | 2024-06-10T11:41:28.401059
  
20000 / tcp
-98713449 | 2024-06-10T12:18:37.143917
  
20256 / tcp
-2031469209 | 2024-06-10T10:32:32.240286
  
20547 / tcp
-98713449 | 2024-06-10T12:09:44.937559
  
21025 / tcp
-2031469209 | 2024-06-10T11:58:36.932165
  
21379 / tcp
-2031469209 | 2024-06-10T11:28:30.089403
  
23023 / tcp
-2031469209 | 2024-06-10T11:39:13.225713
  
23424 / tcp
-98713449 | 2024-06-10T08:34:49.967313
  
25001 / tcp
-98713449 | 2024-06-10T09:03:36.711297
  
25105 / tcp
-2031469209 | 2024-06-10T11:46:52.324279
  
25565 / tcp
-2031469209 | 2024-06-10T08:27:16.180558
  
27015 / tcp
-98713449 | 2024-06-10T08:55:55.854815
  
28015 / tcp
-2031469209 | 2024-06-09T23:13:54.220326
  
28017 / tcp
1094048410 | 2024-05-23T21:38:55.965834
  
28080 / tcp
-2031469209 | 2024-06-10T03:18:05.349320
  
30002 / tcp
-2031469209 | 2024-06-10T05:09:20.168832
  
30003 / tcp
1094048410 | 2024-06-10T12:51:59.529280
  
31337 / tcp
-2031469209 | 2024-06-10T09:22:04.207594
  
32400 / tcp
-2031469209 | 2024-06-10T10:17:20.420244
  
32764 / tcp
-2031469209 | 2024-06-10T04:19:22.743725
  
33060 / tcp
-2031469209 | 2024-06-10T08:28:00.733582
  
35000 / tcp
-2031469209 | 2024-06-10T11:22:59.047496
  
37777 / tcp
-98713449 | 2024-06-10T07:42:12.243687
  
41800 / tcp
-2031469209 | 2024-06-10T06:19:01.103983
  
44158 / tcp
1094048410 | 2024-06-01T18:39:07.583226
  
47990 / tcp
-2031469209 | 2024-06-10T09:27:50.553368
  
49152 / tcp
448794242 | 2024-06-01T15:43:06.791716
  
49153 / tcp
-98713449 | 2024-06-10T10:34:36.962256
  
50000 / tcp
-2031469209 | 2024-06-10T11:16:10.083710
  
50050 / tcp
1869901852 | 2024-06-10T08:25:11.833291
  
50070 / tcp
-2031469209 | 2024-06-10T11:57:37.615508
  
50100 / tcp
-98713449 | 2024-06-10T07:27:56.627587
  
51106 / tcp
-98713449 | 2024-06-10T03:37:47.188300
  
51235 / tcp
-2031469209 | 2024-06-10T07:51:41.155849
  
52869 / tcp
-1959516545 | 2024-06-10T08:58:17.708222
  
53413 / udp
-2031469209 | 2024-06-09T19:37:24.281821
  
54138 / tcp
-98713449 | 2024-06-10T12:02:13.676750
  
55000 / tcp
-2031469209 | 2024-06-10T11:40:14.223462
  
55442 / tcp
1094048410 | 2024-06-10T08:42:38.472566
  
55443 / tcp
1094048410 | 2024-06-10T10:36:48.476714
  
55553 / tcp
-98713449 | 2024-06-10T03:15:07.831958
  
55554 / tcp
-2031469209 | 2024-06-10T03:40:47.174152
  
60001 / tcp
-98713449 | 2024-05-21T02:30:06.788886
  
60010 / tcp
-2031469209 | 2024-06-06T03:05:47.583421
  
60030 / tcp
-2031469209 | 2024-06-10T13:15:49.351966
  
61613 / tcp
-2031469209 | 2024-06-10T10:52:37.976098
  
61616 / tcp
-98713449 | 2024-06-10T08:10:02.080252
  
62078 / tcp



Contact Us

Shodan ® - All rights reserved

\", which results in the enclosed script logic to be executed.","verified":false},"CVE-2020-1971":{"cvss":4.3,"ports":[9080],"summary":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).","verified":false},"CVE-2020-1968":{"cvss":4.3,"ports":[9080],"summary":"The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).","verified":false},"CVE-2020-1934":{"cvss":5.0,"ports":[9080],"summary":"In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.","verified":false},"CVE-2020-1927":{"cvss":5.8,"ports":[9080],"summary":"In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.","verified":false},"CVE-2019-17567":{"cvss":5.0,"ports":[9080],"summary":"Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.","verified":false},"CVE-2019-16884":{"cvss":5.0,"ports":[5000],"summary":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","verified":false},"CVE-2019-13509":{"cvss":5.0,"ports":[5000],"summary":"In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.","verified":false},"CVE-2019-11358":{"cvss":4.3,"ports":[88,4433,8088,8093,9080,50070],"summary":"jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","verified":false},"CVE-2019-11072":{"cvss":7.5,"ports":[88],"summary":"lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malicious HTTP GET request, as demonstrated by mishandling of /%2F? in burl_normalize_2F_to_slash_fix in burl.c. NOTE: The developer states \"The feature which can be abused to cause the crash is a new feature in lighttpd 1.4.50, and is not enabled by default. It must be explicitly configured in the config file (e.g. lighttpd.conf). Certain input will trigger an abort() in lighttpd when that feature is enabled. lighttpd detects the underflow or realloc() will fail (in both 32-bit and 64-bit executables), also detected in lighttpd. Either triggers an explicit abort() by lighttpd. This is not exploitable beyond triggering the explicit abort() with subsequent application exit.","verified":false},"CVE-2019-10247":{"cvss":5.0,"ports":[8000,8888],"summary":"In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.","verified":false},"CVE-2019-10241":{"cvss":4.3,"ports":[8000,8888],"summary":"In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.","verified":false},"CVE-2019-10098":{"cvss":5.8,"ports":[9080],"summary":"In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.","verified":false},"CVE-2019-10092":{"cvss":4.3,"ports":[9080],"summary":"In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.","verified":false},"CVE-2019-9641":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.","verified":false},"CVE-2019-9639":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.","verified":false},"CVE-2019-9638":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.","verified":false},"CVE-2019-9637":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.","verified":false},"CVE-2019-9024":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.","verified":false},"CVE-2019-9023":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.","verified":false},"CVE-2019-9021":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.","verified":false},"CVE-2019-9020":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.","verified":false},"CVE-2019-8331":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.","verified":false},"CVE-2019-6977":{"cvss":6.8,"ports":[9080],"summary":"gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.","verified":false},"CVE-2019-5736":{"cvss":9.3,"ports":[5000],"summary":"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.","verified":false},"CVE-2019-1563":{"cvss":4.3,"ports":[9080],"summary":"In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).","verified":false},"CVE-2019-1559":{"cvss":4.3,"ports":[9080],"summary":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).","verified":false},"CVE-2019-1552":{"cvss":1.9,"ports":[9080],"summary":"OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of 'C:/usr/local', which may be world writable, which enables untrusted users to modify OpenSSL's default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets, including Visual C builds. However, some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1, 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).","verified":false},"CVE-2019-1551":{"cvss":5.0,"ports":[9080],"summary":"There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).","verified":false},"CVE-2019-1547":{"cvss":1.9,"ports":[9080],"summary":"Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).","verified":false},"CVE-2019-0220":{"cvss":5.0,"ports":[9080],"summary":"A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.","verified":false},"CVE-2019-0217":{"cvss":6.0,"ports":[9080],"summary":"In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.","verified":false},"CVE-2018-20783":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.","verified":false},"CVE-2018-20677":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.","verified":false},"CVE-2018-20676":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.","verified":false},"CVE-2018-19520":{"cvss":6.5,"ports":[9080],"summary":"An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.","verified":false},"CVE-2018-19396":{"cvss":5.0,"ports":[9080],"summary":"ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.","verified":false},"CVE-2018-19395":{"cvss":5.0,"ports":[9080],"summary":"ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and com_safearray_proxy return NULL in com_properties_get in ext/com_dotnet/com_handlers.c, as demonstrated by a serialize call on COM(\"WScript.Shell\").","verified":false},"CVE-2018-19052":{"cvss":5.0,"ports":[88],"summary":"An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias target, with a specific mod_alias configuration where the matched alias lacks a trailing '/' character, but the alias target filesystem path does have a trailing '/' character.","verified":false},"CVE-2018-17199":{"cvss":5.0,"ports":[9080],"summary":"In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.","verified":false},"CVE-2018-17188":{"cvss":6.5,"ports":[5984],"summary":"Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cases, this lead to vulnerabilities where CouchDB admin users could access the underlying operating system as the CouchDB user. Together with other vulnerabilities, it allowed full system entry for unauthenticated users. Rather than waiting for new vulnerabilities to be discovered, and fixing them as they come up, the CouchDB development team decided to make changes to avoid this entire class of vulnerabilities.","verified":false},"CVE-2018-17082":{"cvss":4.3,"ports":[9080],"summary":"The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a \"Transfer-Encoding: chunked\" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.","verified":false},"CVE-2018-15514":{"cvss":6.5,"ports":[5000],"summary":"HandleRequestAsync in Docker for Windows before 18.06.0-ce-rc3-win68 (edge) and before 18.06.0-ce-win72 (stable) deserialized requests over the \\\\.\\pipe\\dockerBackend named pipe without verifying the validity of the deserialized .NET objects. This would allow a malicious user in the \"docker-users\" group (who may not otherwise have administrator access) to escalate to administrator privileges.","verified":false},"CVE-2018-15132":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories.","verified":false},"CVE-2018-14883":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.","verified":false},"CVE-2018-14851":{"cvss":4.3,"ports":[9080],"summary":"exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.","verified":false},"CVE-2018-14042":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.","verified":false},"CVE-2018-14040":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.","verified":false},"CVE-2018-12536":{"cvss":5.0,"ports":[8000,8888],"summary":"In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.","verified":false},"CVE-2018-11769":{"cvss":9.0,"ports":[5984],"summary":"CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.","verified":false},"CVE-2018-10549":{"cvss":6.8,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\\0' character.","verified":false},"CVE-2018-10548":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.","verified":false},"CVE-2018-10547":{"cvss":4.3,"ports":[9080],"summary":"An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.","verified":false},"CVE-2018-10546":{"cvss":5.0,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.","verified":false},"CVE-2018-10545":{"cvss":1.9,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.","verified":false},"CVE-2018-8007":{"cvss":9.0,"ports":[5984],"summary":"Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.","verified":false},"CVE-2018-7584":{"cvss":7.5,"ports":[9080],"summary":"In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.","verified":false},"CVE-2018-5712":{"cvss":4.3,"ports":[9080],"summary":"An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.","verified":false},"CVE-2018-5711":{"cvss":4.3,"ports":[9080],"summary":"gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx.","verified":false},"CVE-2018-5407":{"cvss":1.9,"ports":[9080],"summary":"Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.","verified":false},"CVE-2018-1312":{"cvss":6.8,"ports":[9080],"summary":"In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.","verified":false},"CVE-2018-1303":{"cvss":5.0,"ports":[9080],"summary":"A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.","verified":false},"CVE-2018-1302":{"cvss":4.3,"ports":[9080],"summary":"When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.","verified":false},"CVE-2018-1301":{"cvss":4.3,"ports":[9080],"summary":"A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.","verified":false},"CVE-2018-1283":{"cvss":3.5,"ports":[9080],"summary":"In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.","verified":false},"CVE-2018-0739":{"cvss":4.3,"ports":[9080],"summary":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).","verified":false},"CVE-2018-0737":{"cvss":4.3,"ports":[9080],"summary":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).","verified":false},"CVE-2018-0734":{"cvss":4.3,"ports":[9080],"summary":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).","verified":false},"CVE-2018-0732":{"cvss":5.0,"ports":[9080],"summary":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).","verified":false},"CVE-2017-16642":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.","verified":false},"CVE-2017-15715":{"cvss":6.8,"ports":[9080],"summary":"In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.","verified":false},"CVE-2017-15710":{"cvss":5.0,"ports":[9080],"summary":"In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.","verified":false},"CVE-2017-12933":{"cvss":7.5,"ports":[9080],"summary":"The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.","verified":false},"CVE-2017-12868":{"cvss":7.5,"ports":[9080],"summary":"The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.","verified":false},"CVE-2017-12636":{"cvss":9.0,"ports":[5984],"summary":"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.","verified":false},"CVE-2017-12635":{"cvss":10.0,"ports":[5984],"summary":"Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.","verified":false},"CVE-2017-11628":{"cvss":6.8,"ports":[9080],"summary":"In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.","verified":false},"CVE-2017-11147":{"cvss":6.4,"ports":[9080],"summary":"In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.","verified":false},"CVE-2017-11145":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist.","verified":false},"CVE-2017-11144":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.","verified":false},"CVE-2017-11143":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.","verified":false},"CVE-2017-11142":{"cvss":7.8,"ports":[9080],"summary":"In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.","verified":false},"CVE-2017-9798":{"cvss":5.0,"ports":[9080],"summary":"Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.","verified":false},"CVE-2017-9788":{"cvss":6.4,"ports":[9080],"summary":"In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.","verified":false},"CVE-2017-9735":{"cvss":5.0,"ports":[8000,8088,8888,50070],"summary":"Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.","verified":false},"CVE-2017-9226":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.","verified":false},"CVE-2017-9224":{"cvss":7.5,"ports":[9080],"summary":"An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer.","verified":false},"CVE-2017-8923":{"cvss":7.5,"ports":[9080],"summary":"The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.","verified":false},"CVE-2017-7963":{"cvss":5.0,"ports":[9080],"summary":"The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating \"There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior.","verified":false},"CVE-2017-7890":{"cvss":4.3,"ports":[9080],"summary":"The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information.","verified":false},"CVE-2017-7679":{"cvss":7.5,"ports":[9080],"summary":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.","verified":false},"CVE-2017-7658":{"cvss":7.5,"ports":[8000,8088,8888,50070],"summary":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","verified":false},"CVE-2017-7657":{"cvss":7.5,"ports":[8000,8088,8888,50070],"summary":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.","verified":false},"CVE-2017-7656":{"cvss":5.0,"ports":[8000,8088,8888,50070],"summary":"In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.","verified":false},"CVE-2017-7272":{"cvss":5.8,"ports":[9080],"summary":"PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.","verified":false},"CVE-2017-3738":{"cvss":4.3,"ports":[9080],"summary":"There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.","verified":false},"CVE-2017-3737":{"cvss":4.3,"ports":[9080],"summary":"OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an \"error state\" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.","verified":false},"CVE-2017-3736":{"cvss":4.0,"ports":[9080],"summary":"There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.","verified":false},"CVE-2017-3735":{"cvss":5.0,"ports":[9080],"summary":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.","verified":false},"CVE-2017-3167":{"cvss":7.5,"ports":[9080],"summary":"In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.","verified":false},"CVE-2016-10735":{"cvss":4.3,"ports":[8093,50070],"summary":"In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.","verified":false},"CVE-2016-10712":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a \"$uri = stream_get_meta_data(fopen($file, \"r\"))['uri']\" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.","verified":false},"CVE-2016-10707":{"cvss":5.0,"ports":[8093],"summary":"jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.","verified":false},"CVE-2016-10397":{"cvss":5.0,"ports":[9080],"summary":"In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).","verified":false},"CVE-2016-10161":{"cvss":5.0,"ports":[9080],"summary":"The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.","verified":false},"CVE-2016-10159":{"cvss":5.0,"ports":[9080],"summary":"Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.","verified":false},"CVE-2016-10158":{"cvss":5.0,"ports":[9080],"summary":"The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.","verified":false},"CVE-2016-9935":{"cvss":7.5,"ports":[9080],"summary":"The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.","verified":false},"CVE-2016-9934":{"cvss":5.0,"ports":[9080],"summary":"ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.","verified":false},"CVE-2016-9933":{"cvss":5.0,"ports":[9080],"summary":"Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.","verified":false},"CVE-2016-9138":{"cvss":7.5,"ports":[9080],"summary":"PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup.","verified":false},"CVE-2016-9137":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","verified":false},"CVE-2016-8743":{"cvss":5.0,"ports":[9080],"summary":"Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.","verified":false},"CVE-2016-8670":{"cvss":7.5,"ports":[9080],"summary":"Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.","verified":false},"CVE-2016-8612":{"cvss":3.3,"ports":[9080],"summary":"Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.","verified":false},"CVE-2016-7478":{"cvss":5.0,"ports":[9080],"summary":"Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.","verified":false},"CVE-2016-7418":{"cvss":5.0,"ports":[9080],"summary":"The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.","verified":false},"CVE-2016-7417":{"cvss":7.5,"ports":[9080],"summary":"ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.","verified":false},"CVE-2016-7416":{"cvss":5.0,"ports":[9080],"summary":"ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.","verified":false},"CVE-2016-7414":{"cvss":7.5,"ports":[9080],"summary":"The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.","verified":false},"CVE-2016-7413":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.","verified":false},"CVE-2016-7412":{"cvss":6.8,"ports":[9080],"summary":"ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.","verified":false},"CVE-2016-7411":{"cvss":7.5,"ports":[9080],"summary":"ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.","verified":false},"CVE-2016-7132":{"cvss":5.0,"ports":[9080],"summary":"ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.","verified":false},"CVE-2016-7131":{"cvss":5.0,"ports":[9080],"summary":"ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.","verified":false},"CVE-2016-7130":{"cvss":5.0,"ports":[9080],"summary":"The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.","verified":false},"CVE-2016-7129":{"cvss":7.5,"ports":[9080],"summary":"The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.","verified":false},"CVE-2016-7128":{"cvss":5.0,"ports":[9080],"summary":"The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.","verified":false},"CVE-2016-7127":{"cvss":7.5,"ports":[9080],"summary":"The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.","verified":false},"CVE-2016-7126":{"cvss":7.5,"ports":[9080],"summary":"The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.","verified":false},"CVE-2016-7125":{"cvss":5.0,"ports":[9080],"summary":"ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.","verified":false},"CVE-2016-7124":{"cvss":7.5,"ports":[9080],"summary":"ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.","verified":false},"CVE-2016-6297":{"cvss":6.8,"ports":[9080],"summary":"Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.","verified":false},"CVE-2016-6296":{"cvss":7.5,"ports":[9080],"summary":"Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.","verified":false},"CVE-2016-6295":{"cvss":7.5,"ports":[9080],"summary":"ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.","verified":false},"CVE-2016-6294":{"cvss":7.5,"ports":[9080],"summary":"The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.","verified":false},"CVE-2016-6292":{"cvss":4.3,"ports":[9080],"summary":"The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.","verified":false},"CVE-2016-6291":{"cvss":7.5,"ports":[9080],"summary":"The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.","verified":false},"CVE-2016-6290":{"cvss":7.5,"ports":[9080],"summary":"ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.","verified":false},"CVE-2016-6289":{"cvss":6.8,"ports":[9080],"summary":"Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.","verified":false},"CVE-2016-6288":{"cvss":7.5,"ports":[9080],"summary":"The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.","verified":false},"CVE-2016-6174":{"cvss":6.8,"ports":[9080],"summary":"applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.","verified":false},"CVE-2016-5773":{"cvss":7.5,"ports":[9080],"summary":"php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.","verified":false},"CVE-2016-5772":{"cvss":7.5,"ports":[9080],"summary":"Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.","verified":false},"CVE-2016-5771":{"cvss":7.5,"ports":[9080],"summary":"spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.","verified":false},"CVE-2016-5770":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.","verified":false},"CVE-2016-5769":{"cvss":7.5,"ports":[9080],"summary":"Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.","verified":false},"CVE-2016-5768":{"cvss":7.5,"ports":[9080],"summary":"Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.","verified":false},"CVE-2016-5767":{"cvss":6.8,"ports":[9080],"summary":"Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.","verified":false},"CVE-2016-5766":{"cvss":6.8,"ports":[9080],"summary":"Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.","verified":false},"CVE-2016-5399":{"cvss":6.8,"ports":[9080],"summary":"The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.","verified":false},"CVE-2016-5387":{"cvss":6.8,"ports":[9080],"summary":"The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue. NOTE: the vendor states \"This mitigation has been assigned the identifier CVE-2016-5387\"; in other words, this is not a CVE ID for a vulnerability.","verified":false},"CVE-2016-5114":{"cvss":6.4,"ports":[9080],"summary":"sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.","verified":false},"CVE-2016-5096":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.","verified":false},"CVE-2016-5095":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.","verified":false},"CVE-2016-5094":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.","verified":false},"CVE-2016-5093":{"cvss":7.5,"ports":[9080],"summary":"The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.","verified":false},"CVE-2016-4975":{"cvss":4.3,"ports":[9080],"summary":"Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the \"Location\" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).","verified":false},"CVE-2016-4543":{"cvss":7.5,"ports":[9080],"summary":"The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.","verified":false},"CVE-2016-4542":{"cvss":7.5,"ports":[9080],"summary":"The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.","verified":false},"CVE-2016-4541":{"cvss":7.5,"ports":[9080],"summary":"The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.","verified":false},"CVE-2016-4540":{"cvss":7.5,"ports":[9080],"summary":"The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.","verified":false},"CVE-2016-4539":{"cvss":7.5,"ports":[9080],"summary":"The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.","verified":false},"CVE-2016-4538":{"cvss":7.5,"ports":[9080],"summary":"The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.","verified":false},"CVE-2016-4537":{"cvss":7.5,"ports":[9080],"summary":"The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.","verified":false},"CVE-2016-4343":{"cvss":6.8,"ports":[9080],"summary":"The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.","verified":false},"CVE-2016-4342":{"cvss":8.3,"ports":[9080],"summary":"ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive.","verified":false},"CVE-2016-4070":{"cvss":5.0,"ports":[9080],"summary":"Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says \"Not sure if this qualifies as security issue (probably not).","verified":false},"CVE-2016-3185":{"cvss":6.4,"ports":[9080],"summary":"The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (type confusion and application crash) via crafted serialized _cookies data, related to the SoapClient::__call method in ext/soap/soap.c.","verified":false},"CVE-2016-3171":{"cvss":6.8,"ports":[9080],"summary":"Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.","verified":false},"CVE-2016-3142":{"cvss":6.4,"ports":[9080],"summary":"The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\\x05\\x06 signature at an invalid location.","verified":false},"CVE-2016-3141":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.","verified":false},"CVE-2016-2554":{"cvss":10.0,"ports":[9080],"summary":"Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.","verified":false},"CVE-2016-2161":{"cvss":5.0,"ports":[9080],"summary":"In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.","verified":false},"CVE-2016-1903":{"cvss":6.4,"ports":[9080],"summary":"The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.","verified":false},"CVE-2016-0736":{"cvss":5.0,"ports":[9080],"summary":"In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.","verified":false},"CVE-2015-9253":{"cvss":6.8,"ports":[9080],"summary":"An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.","verified":false},"CVE-2015-9251":{"cvss":4.3,"ports":[88,4433,8088,9080,50070],"summary":"jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.","verified":false},"CVE-2015-8994":{"cvss":6.8,"ports":[9080],"summary":"An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode (\"opcode\" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.","verified":false},"CVE-2015-8935":{"cvss":4.3,"ports":[9080],"summary":"The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.","verified":false},"CVE-2015-8879":{"cvss":5.0,"ports":[9080],"summary":"The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.","verified":false},"CVE-2015-8877":{"cvss":5.0,"ports":[9080],"summary":"The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.","verified":false},"CVE-2015-8876":{"cvss":7.5,"ports":[9080],"summary":"Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.","verified":false},"CVE-2015-8874":{"cvss":5.0,"ports":[9080],"summary":"Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.","verified":false},"CVE-2015-8873":{"cvss":5.0,"ports":[9080],"summary":"Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.","verified":false},"CVE-2015-8867":{"cvss":5.0,"ports":[9080],"summary":"The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.","verified":false},"CVE-2015-8865":{"cvss":7.5,"ports":[9080],"summary":"The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.","verified":false},"CVE-2015-8838":{"cvss":4.3,"ports":[9080],"summary":"ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.","verified":false},"CVE-2015-8835":{"cvss":7.5,"ports":[9080],"summary":"The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.","verified":false},"CVE-2015-7804":{"cvss":6.8,"ports":[9080],"summary":"Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.","verified":false},"CVE-2015-7803":{"cvss":6.8,"ports":[9080],"summary":"The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.","verified":false},"CVE-2015-6838":{"cvss":5.0,"ports":[9080],"summary":"The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.","verified":false},"CVE-2015-6837":{"cvss":5.0,"ports":[9080],"summary":"The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.","verified":false},"CVE-2015-6836":{"cvss":7.5,"ports":[9080],"summary":"The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a \"type confusion\" in the serialize_function_call function.","verified":false},"CVE-2015-6835":{"cvss":7.5,"ports":[9080],"summary":"The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.","verified":false},"CVE-2015-6834":{"cvss":7.5,"ports":[9080],"summary":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","verified":false},"CVE-2015-6833":{"cvss":5.0,"ports":[9080],"summary":"Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.","verified":false},"CVE-2015-6832":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.","verified":false},"CVE-2015-6831":{"cvss":7.5,"ports":[9080],"summary":"Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.","verified":false},"CVE-2015-6497":{"cvss":6.5,"ports":[9080],"summary":"The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition (CE) before 1.9.2.1 and Enterprise Edition (EE) before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.","verified":false},"CVE-2015-5590":{"cvss":7.5,"ports":[9080],"summary":"Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.","verified":false},"CVE-2015-5589":{"cvss":10.0,"ports":[9080],"summary":"The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive that is mishandled in a Phar::convertToData call.","verified":false},"CVE-2015-4644":{"cvss":5.0,"ports":[9080],"summary":"The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352.","verified":false},"CVE-2015-4643":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.","verified":false},"CVE-2015-4642":{"cvss":10.0,"ports":[9080],"summary":"The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.","verified":false},"CVE-2015-4605":{"cvss":5.0,"ports":[9080],"summary":"The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a \"Python script text executable\" rule.","verified":false},"CVE-2015-4604":{"cvss":5.0,"ports":[9080],"summary":"The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a \"Python script text executable\" rule.","verified":false},"CVE-2015-4603":{"cvss":10.0,"ports":[9080],"summary":"The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a \"type confusion\" issue.","verified":false},"CVE-2015-4602":{"cvss":10.0,"ports":[9080],"summary":"The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a \"type confusion\" issue.","verified":false},"CVE-2015-4601":{"cvss":10.0,"ports":[9080],"summary":"PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to \"type confusion\" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.","verified":false},"CVE-2015-4600":{"cvss":10.0,"ports":[9080],"summary":"The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to \"type confusion\" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.","verified":false},"CVE-2015-4599":{"cvss":10.0,"ports":[9080],"summary":"The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a \"type confusion\" issue.","verified":false},"CVE-2015-4598":{"cvss":7.5,"ports":[9080],"summary":"PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\\0.html attack that bypasses an intended configuration in which client users may write to only .html files.","verified":false},"CVE-2015-4148":{"cvss":5.0,"ports":[9080],"summary":"The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a \"type confusion\" issue.","verified":false},"CVE-2015-4147":{"cvss":7.5,"ports":[9080],"summary":"The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a \"type confusion\" issue.","verified":false},"CVE-2015-4116":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.","verified":false},"CVE-2015-4026":{"cvss":7.5,"ports":[9080],"summary":"The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \\x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.","verified":false},"CVE-2015-4025":{"cvss":7.5,"ports":[9080],"summary":"PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \\x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.","verified":false},"CVE-2015-4024":{"cvss":5.0,"ports":[9080],"summary":"Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.","verified":false},"CVE-2015-4022":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.","verified":false},"CVE-2015-4021":{"cvss":5.0,"ports":[9080],"summary":"The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \\0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.","verified":false},"CVE-2015-3416":{"cvss":7.5,"ports":[9080],"summary":"The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.","verified":false},"CVE-2015-3415":{"cvss":7.5,"ports":[9080],"summary":"The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.","verified":false},"CVE-2015-3414":{"cvss":7.5,"ports":[9080],"summary":"SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE\"\"\"\"\"\"\"\" at the end of a SELECT statement.","verified":false},"CVE-2015-3412":{"cvss":5.0,"ports":[9080],"summary":"PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.","verified":false},"CVE-2015-3411":{"cvss":6.4,"ports":[9080],"summary":"PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.","verified":false},"CVE-2015-3330":{"cvss":6.8,"ports":[9080],"summary":"The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a \"deconfigured interpreter.\"","verified":false},"CVE-2015-3329":{"cvss":7.5,"ports":[9080],"summary":"Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.","verified":false},"CVE-2015-3307":{"cvss":7.5,"ports":[9080],"summary":"The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.","verified":false},"CVE-2015-3200":{"cvss":5.0,"ports":[88],"summary":"mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.","verified":false},"CVE-2015-3185":{"cvss":4.3,"ports":[9080],"summary":"The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.","verified":false},"CVE-2015-3184":{"cvss":5.0,"ports":[9080],"summary":"mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.","verified":false},"CVE-2015-3183":{"cvss":5.0,"ports":[9080],"summary":"The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.","verified":false},"CVE-2015-3152":{"cvss":4.3,"ports":[9080],"summary":"Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a \"BACKRONYM\" attack.","verified":false},"CVE-2015-2787":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.","verified":false},"CVE-2015-2783":{"cvss":5.8,"ports":[9080],"summary":"ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.","verified":false},"CVE-2015-2348":{"cvss":5.0,"ports":[9080],"summary":"The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \\x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.","verified":false},"CVE-2015-2331":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.","verified":false},"CVE-2015-2326":{"cvss":4.3,"ports":[9080],"summary":"The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by \"((?+1)(\\1))/\".","verified":false},"CVE-2015-2325":{"cvss":6.8,"ports":[9080],"summary":"The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.","verified":false},"CVE-2015-2305":{"cvss":6.8,"ports":[9080],"summary":"Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.","verified":false},"CVE-2015-2301":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.","verified":false},"CVE-2015-1352":{"cvss":5.0,"ports":[9080],"summary":"The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.","verified":false},"CVE-2015-1351":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.","verified":false},"CVE-2015-0273":{"cvss":7.5,"ports":[9080],"summary":"Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.","verified":false},"CVE-2015-0235":{"cvss":10.0,"ports":[9080],"summary":"Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka \"GHOST.\"","verified":false},"CVE-2015-0232":{"cvss":6.8,"ports":[9080],"summary":"The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.","verified":false},"CVE-2015-0231":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.","verified":false},"CVE-2015-0228":{"cvss":5.0,"ports":[9080],"summary":"The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function.","verified":false},"CVE-2014-9912":{"cvss":7.5,"ports":[9080],"summary":"The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.","verified":false},"CVE-2014-9767":{"cvss":4.3,"ports":[9080],"summary":"Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.","verified":false},"CVE-2014-9709":{"cvss":5.0,"ports":[9080],"summary":"The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.","verified":false},"CVE-2014-9705":{"cvss":7.5,"ports":[9080],"summary":"Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.","verified":false},"CVE-2014-9653":{"cvss":7.5,"ports":[9080],"summary":"readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.","verified":false},"CVE-2014-9652":{"cvss":5.0,"ports":[9080],"summary":"The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.","verified":false},"CVE-2014-9427":{"cvss":7.5,"ports":[9080],"summary":"sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.","verified":false},"CVE-2014-9426":{"cvss":7.5,"ports":[9080],"summary":"The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable","verified":false},"CVE-2014-9425":{"cvss":7.5,"ports":[9080],"summary":"Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.","verified":false},"CVE-2014-8142":{"cvss":7.5,"ports":[9080],"summary":"Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.","verified":false},"CVE-2014-8109":{"cvss":4.3,"ports":[9080],"summary":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","verified":false},"CVE-2014-5459":{"cvss":3.6,"ports":[9080],"summary":"The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.","verified":false},"CVE-2014-5120":{"cvss":6.4,"ports":[9080],"summary":"gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.","verified":false},"CVE-2014-4721":{"cvss":2.6,"ports":[9080],"summary":"The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a \"type confusion\" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.","verified":false},"CVE-2014-4698":{"cvss":4.6,"ports":[9080],"summary":"Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.","verified":false},"CVE-2014-4670":{"cvss":4.6,"ports":[9080],"summary":"Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.","verified":false},"CVE-2014-4049":{"cvss":5.1,"ports":[9080],"summary":"Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.","verified":false},"CVE-2014-3981":{"cvss":3.3,"ports":[9080],"summary":"acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.","verified":false},"CVE-2014-3710":{"cvss":5.0,"ports":[9080],"summary":"The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.","verified":false},"CVE-2014-3670":{"cvss":6.8,"ports":[9080],"summary":"The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function.","verified":false},"CVE-2014-3669":{"cvss":7.5,"ports":[9080],"summary":"Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.","verified":false},"CVE-2014-3668":{"cvss":5.0,"ports":[9080],"summary":"Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to an out-of-bounds read operation.","verified":false},"CVE-2014-3597":{"cvss":6.8,"ports":[9080],"summary":"Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.","verified":false},"CVE-2014-3587":{"cvss":4.3,"ports":[9080],"summary":"Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.","verified":false},"CVE-2014-3581":{"cvss":5.0,"ports":[9080],"summary":"The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.","verified":false},"CVE-2014-3538":{"cvss":5.0,"ports":[9080],"summary":"file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.","verified":false},"CVE-2014-3523":{"cvss":5.0,"ports":[9080],"summary":"Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests.","verified":false},"CVE-2014-3515":{"cvss":7.5,"ports":[9080],"summary":"The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to \"type confusion\" issues in (1) ArrayObject and (2) SPLObjectStorage.","verified":false},"CVE-2014-3487":{"cvss":4.3,"ports":[9080],"summary":"The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.","verified":false},"CVE-2014-3480":{"cvss":4.3,"ports":[9080],"summary":"The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.","verified":false},"CVE-2014-3479":{"cvss":4.3,"ports":[9080],"summary":"The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.","verified":false},"CVE-2014-3478":{"cvss":5.0,"ports":[9080],"summary":"Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.","verified":false},"CVE-2014-2497":{"cvss":4.3,"ports":[9080],"summary":"The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.","verified":false},"CVE-2014-2324":{"cvss":5.0,"ports":[88],"summary":"Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.","verified":false},"CVE-2014-2323":{"cvss":7.5,"ports":[88],"summary":"SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.","verified":false},"CVE-2014-2270":{"cvss":4.3,"ports":[9080],"summary":"softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.","verified":false},"CVE-2014-2020":{"cvss":5.0,"ports":[9080],"summary":"ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226.","verified":false},"CVE-2014-1943":{"cvss":5.0,"ports":[9080],"summary":"Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.","verified":false},"CVE-2014-0238":{"cvss":5.0,"ports":[9080],"summary":"The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.","verified":false},"CVE-2014-0237":{"cvss":5.0,"ports":[9080],"summary":"The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.","verified":false},"CVE-2014-0236":{"cvss":5.0,"ports":[9080],"summary":"file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.","verified":false},"CVE-2014-0231":{"cvss":5.0,"ports":[9080],"summary":"The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.","verified":false},"CVE-2014-0226":{"cvss":6.8,"ports":[9080],"summary":"Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.","verified":false},"CVE-2014-0207":{"cvss":4.3,"ports":[9080],"summary":"The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.","verified":false},"CVE-2014-0185":{"cvss":7.2,"ports":[9080],"summary":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","verified":false},"CVE-2014-0118":{"cvss":4.3,"ports":[9080],"summary":"The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.","verified":false},"CVE-2014-0117":{"cvss":4.3,"ports":[9080],"summary":"The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.","verified":false},"CVE-2014-0098":{"cvss":5.0,"ports":[9080],"summary":"The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.","verified":false},"CVE-2013-7456":{"cvss":6.8,"ports":[9080],"summary":"gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.","verified":false},"CVE-2013-7345":{"cvss":5.0,"ports":[9080],"summary":"The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.","verified":false},"CVE-2013-7327":{"cvss":6.8,"ports":[9080],"summary":"The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via invalid imagecrop arguments that lead to use of a NULL pointer as a return value, a different vulnerability than CVE-2013-7226.","verified":false},"CVE-2013-6712":{"cvss":5.0,"ports":[9080],"summary":"The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.","verified":false},"CVE-2013-6501":{"cvss":4.6,"ports":[9080],"summary":"The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.","verified":false},"CVE-2013-6438":{"cvss":5.0,"ports":[9080],"summary":"The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.","verified":false},"CVE-2013-6420":{"cvss":7.5,"ports":[9080],"summary":"The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.","verified":false},"CVE-2013-5704":{"cvss":5.0,"ports":[9080],"summary":"The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states \"this is not a security issue in httpd as such.\"","verified":false},"CVE-2013-4560":{"cvss":5.0,"ports":[88],"summary":"Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.","verified":false},"CVE-2013-4559":{"cvss":7.6,"ports":[88],"summary":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","verified":false},"CVE-2013-4508":{"cvss":4.3,"ports":[88],"summary":"lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.","verified":false},"CVE-2013-4365":{"cvss":7.5,"ports":[9080],"summary":"Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.","verified":false},"CVE-2013-4352":{"cvss":4.3,"ports":[9080],"summary":"The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.","verified":false},"CVE-2013-4248":{"cvss":4.3,"ports":[9080],"summary":"The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","verified":false},"CVE-2013-4113":{"cvss":6.8,"ports":[9080],"summary":"ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.","verified":false},"CVE-2013-3735":{"cvss":5.0,"ports":[9080],"summary":"The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says \"for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.","verified":false},"CVE-2013-2765":{"cvss":5.0,"ports":[9080],"summary":"The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.","verified":false},"CVE-2013-2220":{"cvss":7.5,"ports":[9080],"summary":"Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.","verified":false},"CVE-2013-0942":{"cvss":4.3,"ports":[9080],"summary":"Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","verified":false},"CVE-2013-0941":{"cvss":2.1,"ports":[9080],"summary":"EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.","verified":false},"CVE-2012-6708":{"cvss":4.3,"ports":[88,4433,8088],"summary":"jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.","verified":false},"CVE-2012-5533":{"cvss":5.0,"ports":[88],"summary":"The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the \"Connection: TE,,Keep-Alive\" header.","verified":false},"CVE-2012-4360":{"cvss":4.3,"ports":[9080],"summary":"Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","verified":false},"CVE-2012-4001":{"cvss":5.0,"ports":[9080],"summary":"The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.","verified":false},"CVE-2012-3526":{"cvss":5.0,"ports":[9080],"summary":"The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.","verified":false},"CVE-2012-1171":{"cvss":5.0,"ports":[9080],"summary":"The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.","verified":false},"CVE-2011-4969":{"cvss":4.3,"ports":[88],"summary":"Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.","verified":false},"CVE-2011-4718":{"cvss":6.8,"ports":[9080],"summary":"Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.","verified":false},"CVE-2011-2688":{"cvss":7.5,"ports":[9080],"summary":"SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.","verified":false},"CVE-2011-1176":{"cvss":4.3,"ports":[9080],"summary":"The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.","verified":false},"CVE-2009-3767":{"cvss":4.3,"ports":[9080],"summary":"libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","verified":false},"CVE-2009-3766":{"cvss":6.8,"ports":[9080],"summary":"mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","verified":false},"CVE-2009-3765":{"cvss":6.8,"ports":[9080],"summary":"mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","verified":false},"CVE-2009-2299":{"cvss":5.0,"ports":[9080],"summary":"The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.","verified":false},"CVE-2009-1390":{"cvss":6.8,"ports":[9080],"summary":"Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.","verified":false},"CVE-2009-0796":{"cvss":2.6,"ports":[9080],"summary":"Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.","verified":false},"CVE-2007-4723":{"cvss":7.5,"ports":[9080],"summary":"Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a \"/...../\" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.","verified":false},"CVE-2007-3205":{"cvss":5.0,"ports":[9080],"summary":"The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.","verified":false},"CVE-2006-20001":{"cvss":0,"ports":[9080],"summary":"A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.\n\nThis issue affects Apache HTTP Server 2.4.54 and earlier.\n","verified":false}}; setupBannerCve(); setupVulns(VULNS); })();