Description

PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

Remediation

References

CVE-2000-0967

Related Vulnerabilities

Plone CMS Improper Restriction of XML External Entity Reference Vulnerability (CVE-2020-28734)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3731)

WordPress Plugin Social Media Share Buttons & Social Sharing Icons Security Bypass (1.5.1)

WordPress 4.9.x Multiple Vulnerabilities (4.9 - 4.9.15)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-19211)

Severity

Critical

Classification

CVE-2000-0967

Tags

Missing Update Known Vulnerabilities