4.0.6

DATE	CVE	VULNERABILITY TITLE	RISK
2002-09-24	CVE-2002-0986	Unspecified vulnerability in PHP The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy." network low complexity php	5.0
2002-08-12	CVE-2002-0484	Unspecified vulnerability in PHP move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system. network low complexity php	5.0
2002-05-29	CVE-2002-0253	Information Disclosure vulnerability in PHP Include File Relative Directory PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the include directive to fail, and produces an error message that contains the path. network low complexity php	5.0
2002-05-16	CVE-2002-0229	Unspecified vulnerability in PHP Safe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL database to bypass Safe Mode access restrictions and read arbitrary files using "LOAD DATA INFILE LOCAL" SQL statements. network low complexity php	7.5
2002-03-25	CVE-2002-0121	Local Information Disclosure vulnerability in PHP4 Session Files PHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections. local low complexity php	2.1
2002-03-08	CVE-2002-0081	Buffer Overflow vulnerability in PHP Post File Upload Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled. network low complexity php	7.5