Access Control

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code…CVE-2012-2335Php · 34% likely

   CWE-264

2. The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to…CVE-2011-2202Php · 20% likely

   CWE-264

3. The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INF…CVE-2007-3997Php · 14% likely

   CWE-264

4. The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_…CVE-2009-4018Php · 11% likely

   CWE-264

5. session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which a…CVE-2010-1130Php · 9.5% likely

   CWE-264

6. PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to acces…CVE-2001-1247Php · 9.4% likely

   CWE-264

7. ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which all…CVE-2013-1635Php · 9.4% likely

   CWE-264

8. The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a…CVE-2015-2348Php · 8.3% likely

   CWE-264

9. An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file bein…CVE-2019-9637Php · 7.3% likely

   CWE-264

10. PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent a…CVE-2008-5625Php · 7.3% likely

    CWE-264

11. fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.CVE-2010-3436Php · 6.3% likely

    CWE-264

12. curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary f…CVE-2007-4850Php · 5.6% likely

    CWE-264

13. The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attacke…CVE-2007-3378Php · 5.3% likely

    CWE-264

14. ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers…CVE-2007-5447Php · 4.6% likely

    CWE-264

15. Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.CVE-2011-4718Php · 3.6% likely

    CWE-264

16. The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote…CVE-2007-1461Php · 3.4% likely

    CWE-264

17. PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extensi…CVE-2012-0057Php · 3.0% likely

    CWE-264

18. The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.CVE-2012-3365Php · 3.0% likely

    CWE-264

19. An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issu…CVE-2015-8994Php · 2.9% likely

    CWE-264

20. The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled…CVE-2006-4483Php · 2.9% likely

    CWE-862

21. PHP 5 before 5.2.3 does not enforce the open_basedir or safe_mode restriction in certain cases, which allows context-dependent attackers to determine the existence of arbitrary fi…CVE-2007-3007Php · 2.7% likely

    CWE-264

22. The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to mod…CVE-2010-3065Php · 2.5% likely

    CWE-264

23. Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regress…CVE-2008-0145Php · 2.3% likely

    CWE-264

24. PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to byp…CVE-2008-5624Php · 2.2% likely

    CWE-264

25. The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in gr…CVE-2009-3557Php · 2.1% likely

    CWE-264

26. The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO…CVE-2009-3558Php · 2.1% likely

    CWE-264

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.