Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/43011?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/43011?format=api", "vulnerability_id": "VCID-dcbh-qs9z-ubaw", "summary": "Multiple vulnerabilities have been found in PHP, the worst of which\n could result in the execution of arbitrary shell commands.", "aliases": [ { "alias": "CVE-2018-19518" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/409863?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=x86&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=x86&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/409864?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=x86_64&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=x86_64&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/409859?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=aarch64&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=aarch64&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/409860?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=armhf&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=armhf&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/409861?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=ppc64le&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=ppc64le&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/409862?format=api", "purl": "pkg:apk/alpine/php7@7.1.29-r0?arch=s390x&distroversion=v3.7&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/php7@7.1.29-r0%3Farch=s390x&distroversion=v3.7&reponame=community" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053321?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-6" }, { "url": "http://public2.vulnerablecode.io/api/packages/941979?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-6?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-6%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/941972?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-7?distro=bullseye", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-7%3Fdistro=bullseye" }, { "url": "http://public2.vulnerablecode.io/api/packages/76182?format=api", "purl": "pkg:ebuild/dev-lang/php@7.2.29", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.2.29" }, { "url": "http://public2.vulnerablecode.io/api/packages/76183?format=api", "purl": "pkg:ebuild/dev-lang/php@7.3.16", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/76184?format=api", "purl": "pkg:ebuild/dev-lang/php@7.4.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:ebuild/dev-lang/php@7.4.4" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1049996?format=api", "purl": "pkg:deb/debian/uw-imap@4:2001adebian-6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3exb-uh1x-rkf8" }, { "vulnerability": "VCID-5scr-2vxt-e7gz" }, { "vulnerability": "VCID-6jh1-37ph-2bev" }, { "vulnerability": "VCID-75gm-tz5w-qfan" }, { "vulnerability": "VCID-anhs-xyx5-4fbf" }, { "vulnerability": "VCID-dcbh-qs9z-ubaw" }, { "vulnerability": "VCID-sme9-5sz7-yuh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@4:2001adebian-6" }, { "url": "http://public2.vulnerablecode.io/api/packages/1049997?format=api", "purl": "pkg:deb/debian/uw-imap@7:2002edebian1-11sarge1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3exb-uh1x-rkf8" }, { "vulnerability": "VCID-6jh1-37ph-2bev" }, { "vulnerability": "VCID-75gm-tz5w-qfan" }, { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-11sarge1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1049998?format=api", "purl": "pkg:deb/debian/uw-imap@7:2002edebian1-13.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3exb-uh1x-rkf8" }, { "vulnerability": "VCID-6jh1-37ph-2bev" }, { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-13.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053315?format=api", "purl": "pkg:deb/debian/uw-imap@7:2002edebian1-13.1%2Betch1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3exb-uh1x-rkf8" }, { "vulnerability": "VCID-6jh1-37ph-2bev" }, { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2002edebian1-13.1%252Betch1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053316?format=api", "purl": "pkg:deb/debian/uw-imap@7:2007b~dfsg-4%2Blenny3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3exb-uh1x-rkf8" }, { "vulnerability": "VCID-6jh1-37ph-2bev" }, { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@7:2007b~dfsg-4%252Blenny3" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053317?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007e~dfsg-3.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007e~dfsg-3.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053318?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-2" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053319?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-4" }, { "url": "http://public2.vulnerablecode.io/api/packages/1053320?format=api", "purl": "pkg:deb/debian/uw-imap@8:2007f~dfsg-5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-dcbh-qs9z-ubaw" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/uw-imap@8:2007f~dfsg-5" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-19518.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-19518.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-19518", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.93869", "scoring_system": "epss", "scoring_elements": "0.99874", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.93869", "scoring_system": "epss", "scoring_elements": "0.9987", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.93869", "scoring_system": "epss", "scoring_elements": "0.99871", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.93869", "scoring_system": "epss", "scoring_elements": "0.99872", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.93869", "scoring_system": "epss", "scoring_elements": "0.99873", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.93956", "scoring_system": "epss", "scoring_elements": "0.99883", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.93956", "scoring_system": "epss", "scoring_elements": "0.99884", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.93956", "scoring_system": "epss", "scoring_elements": "0.99882", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-19518" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14851", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14851" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14883", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14883" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17082", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17082" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19518", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19518" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19935", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19935" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20783" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1654228", "reference_id": "1654228", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1654228" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914632", "reference_id": "914632", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914632" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45914.rb", "reference_id": "CVE-2018-19518", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/45914.rb" }, { "reference_url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb", "reference_id": "CVE-2018-19518", "reference_type": "exploit", "scores": [], "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb" }, { "reference_url": "https://security.gentoo.org/glsa/202003-57", "reference_id": "GLSA-202003-57", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202003-57" }, { "reference_url": "https://usn.ubuntu.com/4160-1/", "reference_id": "USN-4160-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4160-1/" } ], "weaknesses": [ { "cwe_id": 78, "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "description": "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component." } ], "exploits": [ { "date_added": "2018-11-29", "description": "PHP imap_open - Remote Code Execution (Metasploit)", "required_action": null, "due_date": null, "notes": null, "known_ransomware_campaign_use": true, "source_date_published": "2018-11-29", "exploit_type": "remote", "platform": "linux", "source_date_updated": "2018-11-29", "data_source": "Exploit-DB", "source_url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/b3ad4a03581f53c670d91e82d2a4ef00ec392f8f/modules/exploits/linux/http/php_imap_open_rce.rb" }, { "date_added": null, "description": "The imap_open function within php, if called without the /norsh flag, will attempt to preauthenticate an\n IMAP session. On Debian based systems, including Ubuntu, rsh is mapped to the ssh binary. Ssh's ProxyCommand\n option can be passed from imap_open to execute arbitrary commands.\n While many custom applications may use imap_open, this exploit works against the following applications:\n e107 v2, prestashop, SuiteCRM, as well as Custom, which simply prints the exploit strings for use.\n Prestashop exploitation requires the admin URI, and administrator credentials.\n suiteCRM/e107 require administrator credentials. Fixed in php 5.6.39.", "required_action": null, "due_date": null, "notes": "Reliability:\n - unknown-reliability\nStability:\n - unknown-stability\nSideEffects:\n - unknown-side-effects\n", "known_ransomware_campaign_use": false, "source_date_published": "2018-10-23", "exploit_type": null, "platform": "Unix", "source_date_updated": null, "data_source": "Metasploit", "source_url": "https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/http/php_imap_open_rce.rb" } ], "severity_range_score": "5.3 - 8.1", "exploitability": "2.0", "weighted_severity": "7.3", "risk_score": 10.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dcbh-qs9z-ubaw" }