All the vulnerabilites related to phpmyadmin - phpmyadmin
cve-2016-4412
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 00:25
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94519 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-57 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:25:14.478Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94519",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94519"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-57"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user\u0027s valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94519",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94519"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-57"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-4412",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user\u0027s valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94519",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94519"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-57",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-57"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-4412",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-04-30T00:00:00",
"dateUpdated": "2024-08-06T00:25:14.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6943
Vulnerability from cvelistv5
Published
2007-01-19 02:00
Modified
2024-08-07 20:42
Severity ?
EPSS score ?
Summary
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8 | x_refsource_CONFIRM | |
| http://marc.info/?l=bugtraq&m=116370414309444&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/21137 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:42:07.840Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "21137",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21137"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "21137",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21137"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6943",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "21137",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21137"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6943",
"datePublished": "2007-01-19T02:00:00",
"dateReserved": "2007-01-18T00:00:00",
"dateUpdated": "2024-08-07T20:42:07.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-12613
Vulnerability from cvelistv5
Published
2018-06-21 20:00
Modified
2024-08-05 08:38
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2018-4/ | x_refsource_CONFIRM | |
| https://www.exploit-db.com/exploits/45020/ | exploit, x_refsource_EXPLOIT-DB | |
| http://www.securityfocus.com/bid/104532 | vdb-entry, x_refsource_BID | |
| https://www.exploit-db.com/exploits/44924/ | exploit, x_refsource_EXPLOIT-DB | |
| https://www.exploit-db.com/exploits/44928/ | exploit, x_refsource_EXPLOIT-DB | |
| https://security.gentoo.org/glsa/201904-16 | vendor-advisory, x_refsource_GENTOO | |
| http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T08:38:06.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-4/"
},
{
"name": "45020",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45020/"
},
{
"name": "104532",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/104532"
},
{
"name": "44924",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44924/"
},
{
"name": "44928",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44928/"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg[\u0027AllowArbitraryServer\u0027] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg[\u0027ServerDefault\u0027] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-25T18:06:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-4/"
},
{
"name": "45020",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45020/"
},
{
"name": "104532",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/104532"
},
{
"name": "44924",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44924/"
},
{
"name": "44928",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44928/"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12613",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg[\u0027AllowArbitraryServer\u0027] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg[\u0027ServerDefault\u0027] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-4/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-4/"
},
{
"name": "45020",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45020/"
},
{
"name": "104532",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/104532"
},
{
"name": "44924",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44924/"
},
{
"name": "44928",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44928/"
},
{
"name": "GLSA-201904-16",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"name": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-12613",
"datePublished": "2018-06-21T20:00:00",
"dateReserved": "2018-06-21T00:00:00",
"dateUpdated": "2024-08-05T08:38:06.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2031
Vulnerability from cvelistv5
Published
2006-04-26 00:00
Modified
2024-08-07 17:35
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/19659 | third-party-advisory, x_refsource_SECUNIA | |
| http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html | x_refsource_MISC | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25954 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:35:31.196Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19659"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"name": "phpmyadmin-index-xss(25954)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25954"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19659"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"name": "phpmyadmin-index-xss(25954)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25954"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2031",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "19659",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19659"
},
{
"name": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html",
"refsource": "MISC",
"url": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"name": "phpmyadmin-index-xss(25954)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25954"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2031",
"datePublished": "2006-04-26T00:00:00",
"dateReserved": "2006-04-25T00:00:00",
"dateUpdated": "2024-08-07T17:35:31.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-3197
Vulnerability from cvelistv5
Published
2008-07-16 18:00
Modified
2024-08-07 09:28
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:28:41.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-6502",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html"
},
{
"name": "phpmyadmin-multi-csrf(43846)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43846"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=613660"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "[oss-security] 20080715 CVE request: phpmyadmin \u003c 2.11.7.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/07/15/6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6450",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "ADV-2008-2116",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2116/references"
},
{
"name": "31097",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31097"
},
{
"name": "31115",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31115"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the \"Creating a Database\" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-6502",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html"
},
{
"name": "phpmyadmin-multi-csrf(43846)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43846"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=613660"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "[oss-security] 20080715 CVE request: phpmyadmin \u003c 2.11.7.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/07/15/6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6450",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "ADV-2008-2116",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2116/references"
},
{
"name": "31097",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31097"
},
{
"name": "31115",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31115"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3197",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the \"Creating a Database\" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2008:202",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-6502",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html"
},
{
"name": "phpmyadmin-multi-csrf(43846)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43846"
},
{
"name": "http://sourceforge.net/project/shownotes.php?release_id=613660",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/project/shownotes.php?release_id=613660"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5"
},
{
"name": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf",
"refsource": "MISC",
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "[oss-security] 20080715 CVE request: phpmyadmin \u003c 2.11.7.1",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/07/15/6"
},
{
"name": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf",
"refsource": "MISC",
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6450",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html"
},
{
"name": "DSA-1641",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "ADV-2008-2116",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2116/references"
},
{
"name": "31097",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31097"
},
{
"name": "31115",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31115"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3197",
"datePublished": "2008-07-16T18:00:00",
"dateReserved": "2008-07-16T00:00:00",
"dateUpdated": "2024-08-07T09:28:41.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5702
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:07
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-18/ | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-18/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-18/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5702",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-18/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-18/"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5702",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5734
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/40185/ | exploit, x_refsource_EXPLOIT-DB | |
| https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/91387 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-27/ | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.523Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40185",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40185/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7"
},
{
"name": "91387",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91387"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-27/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40185",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40185/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7"
},
{
"name": "91387",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91387"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-27/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5734",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40185",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40185/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7"
},
{
"name": "91387",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91387"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-27/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-27/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5734",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-21T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4729
Vulnerability from cvelistv5
Published
2013-07-04 10:00
Modified
2024-09-16 16:28
Severity ?
EPSS score ?
Summary
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36 | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:27.077Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-04T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4729",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4729",
"datePublished": "2013-07-04T10:00:00Z",
"dateReserved": "2013-06-29T00:00:00Z",
"dateUpdated": "2024-09-16T16:28:42.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-12922
Vulnerability from cvelistv5
Published
2019-09-13 12:27
Modified
2024-08-04 23:32
Severity ?
EPSS score ?
Summary
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:32:55.578Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/Sep/23"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html"
},
{
"name": "Exploit Database",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/47385"
},
{
"name": "openSUSE-SU-2019:2211",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html"
},
{
"name": "FEDORA-2019-644b438f51",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/"
},
{
"name": "FEDORA-2019-3b5a7abe17",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/"
},
{
"name": "FEDORA-2019-6404181bf9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-14T21:06:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2019/Sep/23"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html"
},
{
"name": "Exploit Database",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/47385"
},
{
"name": "openSUSE-SU-2019:2211",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html"
},
{
"name": "FEDORA-2019-644b438f51",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/"
},
{
"name": "FEDORA-2019-3b5a7abe17",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/"
},
{
"name": "FEDORA-2019-6404181bf9",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-12922",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2019/Sep/23",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2019/Sep/23"
},
{
"name": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html"
},
{
"name": "Exploit Database",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/47385"
},
{
"name": "openSUSE-SU-2019:2211",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html"
},
{
"name": "FEDORA-2019-644b438f51",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/"
},
{
"name": "FEDORA-2019-3b5a7abe17",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/"
},
{
"name": "FEDORA-2019-6404181bf9",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b"
},
{
"name": "openSUSE-SU-2020:0056",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-12922",
"datePublished": "2019-09-13T12:27:04",
"dateReserved": "2019-06-20T00:00:00",
"dateUpdated": "2024-08-04T23:32:55.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-3456
Vulnerability from cvelistv5
Published
2008-08-04 19:00
Modified
2024-08-07 09:37
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:37:27.077Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6810",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"name": "phpmyadmin-multiple-weak-security(44050)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44050"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31263"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6810",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"name": "phpmyadmin-multiple-weak-security(44050)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44050"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31263"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3456",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2008:202",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"name": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf",
"refsource": "MISC",
"url": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf"
},
{
"name": "FEDORA-2008-6810",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"name": "phpmyadmin-multiple-weak-security(44050)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44050"
},
{
"name": "32834",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "DSA-1641",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31263"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3456",
"datePublished": "2008-08-04T19:00:00",
"dateReserved": "2008-08-04T00:00:00",
"dateUpdated": "2024-08-07T09:37:27.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4782
Vulnerability from cvelistv5
Published
2011-12-22 20:00
Modified
2024-08-07 00:16
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/71938 | vdb-entry, x_refsource_XF | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cd | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:198 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:16:34.619Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-configfileclass-xss(71938)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71938"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cd"
},
{
"name": "FEDORA-2011-17370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-12-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-configfileclass-xss(71938)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71938"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cd"
},
{
"name": "FEDORA-2011-17370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4782",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-configfileclass-xss(71938)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71938"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=0e707906e69ce90c4852a0fce2a0fac7db86a3cd",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=0e707906e69ce90c4852a0fce2a0fac7db86a3cd"
},
{
"name": "FEDORA-2011-17370",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4782",
"datePublished": "2011-12-22T20:00:00",
"dateReserved": "2011-12-13T00:00:00",
"dateUpdated": "2024-08-07T00:16:34.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3239
Vulnerability from cvelistv5
Published
2013-04-26 01:00
Modified
2024-08-06 16:00
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:00:10.109Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2013:160",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48"
},
{
"name": "FEDORA-2013-6977",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php"
},
{
"name": "FEDORA-2013-7000",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-05-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2013:160",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48"
},
{
"name": "FEDORA-2013-6977",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php"
},
{
"name": "FEDORA-2013-7000",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3239",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2013:160",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "openSUSE-SU-2013:1065",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48"
},
{
"name": "FEDORA-2013-6977",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php"
},
{
"name": "FEDORA-2013-7000",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a"
},
{
"name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133",
"refsource": "CONFIRM",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3239",
"datePublished": "2013-04-26T01:00:00",
"dateReserved": "2013-04-22T00:00:00",
"dateUpdated": "2024-08-06T16:00:10.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5589
Vulnerability from cvelistv5
Published
2007-10-19 23:00
Modified
2024-08-07 15:39
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:39:13.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2007-3535",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3535"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796"
},
{
"name": "27246",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27246"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796"
},
{
"name": "FEDORA-2007-2738",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "phpmyadmin-serverstatus-xss(37292)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37292"
},
{
"name": "27506",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27506"
},
{
"name": "26301",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26301"
},
{
"name": "DSA-1403",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "SUSE-SR:2008:006",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"name": "37939",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/37939"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27595"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"name": "29323",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29323"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2007-3535",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3535"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796"
},
{
"name": "27246",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27246"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796"
},
{
"name": "FEDORA-2007-2738",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "phpmyadmin-serverstatus-xss(37292)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37292"
},
{
"name": "27506",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27506"
},
{
"name": "26301",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26301"
},
{
"name": "DSA-1403",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "SUSE-SR:2008:006",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"name": "37939",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/37939"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27595"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"name": "29323",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29323"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5589",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-3535",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3535"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796"
},
{
"name": "27246",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27246"
},
{
"name": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html",
"refsource": "MISC",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796"
},
{
"name": "FEDORA-2007-2738",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "phpmyadmin-serverstatus-xss(37292)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37292"
},
{
"name": "27506",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27506"
},
{
"name": "26301",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26301"
},
{
"name": "DSA-1403",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "SUSE-SR:2008:006",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"name": "37939",
"refsource": "OSVDB",
"url": "http://osvdb.org/37939"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27595"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=333661",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"name": "29323",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29323"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5589",
"datePublished": "2007-10-19T23:00:00",
"dateReserved": "2007-10-19T00:00:00",
"dateUpdated": "2024-08-07T15:39:13.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-18264
Vulnerability from cvelistv5
Published
2018-05-01 17:00
Modified
2024-08-05 21:13
Severity ?
EPSS score ?
Summary
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2017-8/ | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/97211 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:13:49.227Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-8/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "97211",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97211"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-05-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given \u0027\u0027 as the first argument."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-8/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "97211",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97211"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18264",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given \u0027\u0027 as the first argument."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-8/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-8/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "97211",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97211"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18264",
"datePublished": "2018-05-01T17:00:00",
"dateReserved": "2018-05-01T00:00:00",
"dateUpdated": "2024-08-05T21:13:49.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0203
Vulnerability from cvelistv5
Published
2007-01-11 11:00
Modified
2024-08-07 12:12
Severity ?
EPSS score ?
Summary
Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 | x_refsource_CONFIRM | |
| http://osvdb.org/32666 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/21987 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/23702 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2007/0125 | vdb-entry, x_refsource_VUPEN | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:12:17.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "32666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32666"
},
{
"name": "21987",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23702"
},
{
"name": "ADV-2007-0125",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-01-17T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "32666",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32666"
},
{
"name": "21987",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23702"
},
{
"name": "ADV-2007-0125",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0203",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "32666",
"refsource": "OSVDB",
"url": "http://osvdb.org/32666"
},
{
"name": "21987",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23702"
},
{
"name": "ADV-2007-0125",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0203",
"datePublished": "2007-01-11T11:00:00",
"dateReserved": "2007-01-10T00:00:00",
"dateUpdated": "2024-08-07T12:12:17.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-3902
Vulnerability from cvelistv5
Published
2015-05-26 15:00
Modified
2024-08-06 05:56
Severity ?
EPSS score ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1032404 | vdb-entry, x_refsource_SECTRACK | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/74657 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:56:16.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83"
},
{
"name": "1032404",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032404"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php"
},
{
"name": "74657",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74657"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-23T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83"
},
{
"name": "1032404",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032404"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php"
},
{
"name": "74657",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74657"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2015:1191",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83"
},
{
"name": "1032404",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032404"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php"
},
{
"name": "74657",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74657"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3902",
"datePublished": "2015-05-26T15:00:00",
"dateReserved": "2015-05-12T00:00:00",
"dateUpdated": "2024-08-06T05:56:16.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0459
Vulnerability from cvelistv5
Published
2005-02-17 05:00
Modified
2024-08-07 21:13
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1013210 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:13:54.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1013210",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1013210"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-02-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-04-26T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1013210",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1013210"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0459",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1013210",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1013210"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0459",
"datePublished": "2005-02-17T05:00:00",
"dateReserved": "2005-02-17T00:00:00",
"dateUpdated": "2024-08-07T21:13:54.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2043
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:49.774Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-21T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2043",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php"
},
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2043",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:49.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-18622
Vulnerability from cvelistv5
Published
2019-11-22 20:32
Modified
2024-08-05 01:54
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2019-5/ | x_refsource_CONFIRM | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html | vendor-advisory, x_refsource_SUSE | |
| https://security.gentoo.org/glsa/202003-39 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:54:14.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-5/"
},
{
"name": "FEDORA-2019-8f55b515f1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/"
},
{
"name": "FEDORA-2019-db68ae1fca",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/"
},
{
"name": "openSUSE-SU-2019:2599",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "GLSA-202003-39",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-39"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-19T17:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-5/"
},
{
"name": "FEDORA-2019-8f55b515f1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/"
},
{
"name": "FEDORA-2019-db68ae1fca",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/"
},
{
"name": "openSUSE-SU-2019:2599",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "GLSA-202003-39",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202003-39"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-18622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2019-5/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-5/"
},
{
"name": "FEDORA-2019-8f55b515f1",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/"
},
{
"name": "FEDORA-2019-db68ae1fca",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/"
},
{
"name": "openSUSE-SU-2019:2599",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html"
},
{
"name": "openSUSE-SU-2020:0056",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "GLSA-202003-39",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202003-39"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-18622",
"datePublished": "2019-11-22T20:32:52",
"dateReserved": "2019-10-29T00:00:00",
"dateUpdated": "2024-08-05T01:54:14.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5739
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-28/ | x_refsource_CONFIRM | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.securityfocus.com/bid/91389 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.673Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-28/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91389",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91389"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-28/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91389",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91389"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5739",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-28/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-28/"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91389",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91389"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5739",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-22T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5003
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-08-06 16:59
Severity ?
EPSS score ?
Summary
Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/61923 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/59832 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "61923",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61923"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59832"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "61923",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61923"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59832"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5003",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "61923",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61923"
},
{
"name": "59832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59832"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5003",
"datePublished": "2013-07-30T18:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:41.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000018
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95738 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2017-7 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:06.073Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95738",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95738"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-7"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-27T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95738",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95738"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-7"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.269483",
"ID": "CVE-2017-1000018",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95738",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95738"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-7",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-7"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000018",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:06.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-1149
Vulnerability from cvelistv5
Published
2009-03-26 14:00
Modified
2024-08-07 05:04
Severity ?
EPSS score ?
Summary
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303 | x_refsource_MISC | |
| http://secunia.com/advisories/34642 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/34468 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:04:48.368Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34468"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-04-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34468"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1149",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303",
"refsource": "MISC",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34468"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1149",
"datePublished": "2009-03-26T14:00:00",
"dateReserved": "2009-03-26T00:00:00",
"dateUpdated": "2024-08-07T05:04:48.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4107
Vulnerability from cvelistv5
Published
2011-11-17 19:00
Modified
2024-08-07 00:01
Severity ?
EPSS score ?
Summary
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:01:50.500Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-xml-info-disclosure(71108)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"
},
{
"name": "46447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46447"
},
{
"name": "76798",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/76798"
},
{
"name": "FEDORA-2011-15846",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"
},
{
"name": "[oss-security] 20111103 Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5"
},
{
"name": "20111102 PhpMyAdmin Arbitrary File Reading",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2011/Nov/21"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"
},
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "FEDORA-2011-15831",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"
},
{
"name": "50497",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/50497"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112"
},
{
"name": "8533",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8533"
},
{
"name": "[oss-security] 20111103 CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.wooyun.org/bugs/wooyun-2010-03185"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"
},
{
"name": "FEDORA-2011-15841",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-11-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "phpmyadmin-xml-info-disclosure(71108)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"
},
{
"name": "46447",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46447"
},
{
"name": "76798",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/76798"
},
{
"name": "FEDORA-2011-15846",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"
},
{
"name": "[oss-security] 20111103 Re: CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5"
},
{
"name": "20111102 PhpMyAdmin Arbitrary File Reading",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2011/Nov/21"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"
},
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "FEDORA-2011-15831",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"
},
{
"name": "50497",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/50497"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112"
},
{
"name": "8533",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8533"
},
{
"name": "[oss-security] 20111103 CVE Request -- phpMyAdmin -- Arbitrary local file read flaw by loading XML strings / importing XML files",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.wooyun.org/bugs/wooyun-2010-03185"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"
},
{
"name": "FEDORA-2011-15841",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-4107",
"datePublished": "2011-11-17T19:00:00",
"dateReserved": "2011-10-18T00:00:00",
"dateUpdated": "2024-08-07T00:01:50.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-4306
Vulnerability from cvelistv5
Published
2007-08-13 21:00
Modified
2024-08-07 14:53
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/25268 | vdb-entry, x_refsource_BID | |
| http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html | x_refsource_MISC | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T14:53:55.981Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "25268",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/25268"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-08-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-08-16T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "25268",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/25268"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-4306",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "25268",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/25268"
},
{
"name": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html",
"refsource": "MISC",
"url": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-4306",
"datePublished": "2007-08-13T21:00:00",
"dateReserved": "2007-08-13T00:00:00",
"dateUpdated": "2024-08-07T14:53:55.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3665
Vulnerability from cvelistv5
Published
2005-12-08 11:00
Modified
2024-08-07 23:17
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/423142/100/0/threaded | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 | x_refsource_CONFIRM | |
| http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml | vendor-advisory, x_refsource_GENTOO | |
| http://www.debian.org/security/2006/dsa-1207 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/22781 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/15735 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/17957 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/2772 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/18618 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/17895 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:17:23.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
},
{
"name": "GLSA-200512-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "15735",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15735"
},
{
"name": "17957",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17957"
},
{
"name": "ADV-2005-2772",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2772"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18618"
},
{
"name": "17895",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17895"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
},
{
"name": "GLSA-200512-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "15735",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15735"
},
{
"name": "17957",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17957"
},
{
"name": "ADV-2005-2772",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2772"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18618"
},
{
"name": "17895",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17895"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2005-3665",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SA:2006:004",
"refsource": "SUSE",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
},
{
"name": "GLSA-200512-03",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "DSA-1207",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22781"
},
{
"name": "15735",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15735"
},
{
"name": "17957",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17957"
},
{
"name": "ADV-2005-2772",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2772"
},
{
"name": "18618",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18618"
},
{
"name": "17895",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17895"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2005-3665",
"datePublished": "2005-12-08T11:00:00",
"dateReserved": "2005-11-18T00:00:00",
"dateUpdated": "2024-08-07T23:17:23.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-7252
Vulnerability from cvelistv5
Published
2010-01-19 16:00
Modified
2024-08-07 11:56
Severity ?
EPSS score ?
Summary
libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/38211 | third-party-advisory, x_refsource_SECUNIA | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=11528 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/39503 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html | vendor-advisory, x_refsource_SUSE | |
| http://www.vupen.com/english/advisories/2010/0910 | vdb-entry, x_refsource_VUPEN | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528&r2=11527&pathrev=11528 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2010/dsa-2034 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/37826 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:56:14.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/38211"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
},
{
"name": "37826",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37826"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-01-28T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/38211"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
},
{
"name": "37826",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37826"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-7252",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38211",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/38211"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"name": "39503",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"name": "DSA-2034",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
},
{
"name": "37826",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37826"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-7252",
"datePublished": "2010-01-19T16:00:00",
"dateReserved": "2010-01-12T00:00:00",
"dateUpdated": "2024-08-07T11:56:14.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2038
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.114Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-21T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2038",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3"
},
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2038",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:50.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-6100
Vulnerability from cvelistv5
Published
2007-11-23 20:00
Modified
2024-08-07 15:54
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2007/3943 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/38601 | vdb-entry, x_refsource_XF | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/27748 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/26513 | vdb-entry, x_refsource_BID | |
| http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html | vendor-advisory, x_refsource_SUSE | |
| http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc | x_refsource_MISC | |
| http://secunia.com/advisories/29323 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:54:26.575Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2007-3943",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3943"
},
{
"name": "phpmyadmin-loginpage-xss(38601)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38601"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8"
},
{
"name": "27748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27748"
},
{
"name": "26513",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26513"
},
{
"name": "SUSE-SR:2008:006",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc"
},
{
"name": "29323",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29323"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-11-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2007-3943",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3943"
},
{
"name": "phpmyadmin-loginpage-xss(38601)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38601"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8"
},
{
"name": "27748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27748"
},
{
"name": "26513",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26513"
},
{
"name": "SUSE-SR:2008:006",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc"
},
{
"name": "29323",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29323"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6100",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-3943",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3943"
},
{
"name": "phpmyadmin-loginpage-xss(38601)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38601"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8"
},
{
"name": "27748",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27748"
},
{
"name": "26513",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26513"
},
{
"name": "SUSE-SR:2008:006",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"name": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc",
"refsource": "MISC",
"url": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc"
},
{
"name": "29323",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29323"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6100",
"datePublished": "2007-11-23T20:00:00",
"dateReserved": "2007-11-23T00:00:00",
"dateUpdated": "2024-08-07T15:54:26.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2044
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:49.870Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-21T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2044",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2044",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:49.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-8959
Vulnerability from cvelistv5
Published
2014-11-30 11:00
Modified
2024-08-06 13:33
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/71247 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961 | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:228 | vendor-advisory, x_refsource_MANDRIVA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:12.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "71247",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71247"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "71247",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71247"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8959",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "71247",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71247"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961"
},
{
"name": "MDVSA-2014:228",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8959",
"datePublished": "2014-11-30T11:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T13:33:12.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-23807
Vulnerability from cvelistv5
Published
2022-01-22 00:00
Modified
2024-08-03 03:51
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2022-1/ | ||
| https://security.gentoo.org/glsa/202311-17 | vendor-advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:51:46.021Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-1/"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-26T12:06:11.924887",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.phpmyadmin.net/security/PMASA-2022-1/"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
],
"source": {
"discovery": "INTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-23807",
"datePublished": "2022-01-22T00:00:00",
"dateReserved": "2022-01-21T00:00:00",
"dateUpdated": "2024-08-03T03:51:46.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-1150
Vulnerability from cvelistv5
Published
2009-03-26 14:00
Modified
2024-08-07 05:04
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php | x_refsource_CONFIRM | |
| http://security.gentoo.org/glsa/glsa-200906-03.xml | vendor-advisory, x_refsource_GENTOO | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986&r2=12302&pathrev=12302 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/34251 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/34642 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.debian.org/security/2009/dsa-1824 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html | vendor-advisory, x_refsource_SUSE | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:115 | vendor-advisory, x_refsource_MANDRIVA | |
| http://secunia.com/advisories/34430 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/35635 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/35585 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:04:48.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php"
},
{
"name": "GLSA-200906-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302"
},
{
"name": "34251",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/34251"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "DSA-1824",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34430",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35635"
},
{
"name": "35585",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35585"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-04-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php"
},
{
"name": "GLSA-200906-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302"
},
{
"name": "34251",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/34251"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "DSA-1824",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34430",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35635"
},
{
"name": "35585",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35585"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1150",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php"
},
{
"name": "GLSA-200906-03",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302"
},
{
"name": "34251",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34251"
},
{
"name": "34642",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34642"
},
{
"name": "DSA-1824",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34430",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35635"
},
{
"name": "35585",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35585"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1150",
"datePublished": "2009-03-26T14:00:00",
"dateReserved": "2009-03-26T00:00:00",
"dateUpdated": "2024-08-07T05:04:48.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000499
Vulnerability from cvelistv5
Published
2018-01-03 14:00
Modified
2024-08-05 22:00
Severity ?
EPSS score ?
Summary
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1040163 | vdb-entry, x_refsource_SECTRACK | |
| http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/45284/ | exploit, x_refsource_EXPLOIT-DB | |
| https://www.phpmyadmin.net/security/PMASA-2017-9/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:00:41.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1040163",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1040163"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/"
},
{
"name": "45284",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45284/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-9/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-12-29T00:00:00",
"datePublic": "2017-12-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-08-31T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1040163",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1040163"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/"
},
{
"name": "45284",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45284/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-9/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-12-29",
"ID": "CVE-2017-1000499",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1040163",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1040163"
},
{
"name": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/",
"refsource": "MISC",
"url": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/"
},
{
"name": "45284",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45284/"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-9/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-9/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000499",
"datePublished": "2018-01-03T14:00:00",
"dateReserved": "2018-01-03T00:00:00",
"dateUpdated": "2024-08-05T22:00:41.653Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3299
Vulnerability from cvelistv5
Published
2005-10-23 04:00
Modified
2024-08-07 23:10
Severity ?
EPSS score ?
Summary
PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/17137 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml | vendor-advisory, x_refsource_GENTOO | |
| http://securityreason.com/securityalert/69 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/15053 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:10:08.593Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4"
},
{
"name": "17137",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17137"
},
{
"name": "GLSA-200510-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml"
},
{
"name": "69",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/69"
},
{
"name": "15053",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15053"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-08-22T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4"
},
{
"name": "17137",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17137"
},
{
"name": "GLSA-200510-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml"
},
{
"name": "69",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/69"
},
{
"name": "15053",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15053"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3299",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4"
},
{
"name": "17137",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17137"
},
{
"name": "GLSA-200510-16",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml"
},
{
"name": "69",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/69"
},
{
"name": "15053",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15053"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3299",
"datePublished": "2005-10-23T04:00:00",
"dateReserved": "2005-10-23T00:00:00",
"dateUpdated": "2024-08-07T23:10:08.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9865
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://www.phpmyadmin.net/security/PMASA-2016-70 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94531 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.621Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-70"
},
{
"name": "94531",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94531"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-70"
},
{
"name": "94531",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94531"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9865",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-70",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-70"
},
{
"name": "94531",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94531"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9865",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3241
Vulnerability from cvelistv5
Published
2013-04-26 01:00
Modified
2024-08-06 16:00
Severity ?
EPSS score ?
Summary
export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:00:10.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-19T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3241",
"datePublished": "2013-04-26T01:00:00",
"dateReserved": "2013-04-22T00:00:00",
"dateUpdated": "2024-08-06T16:00:10.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9853
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-63 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94527 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9853",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9853",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1148
Vulnerability from cvelistv5
Published
2004-12-15 05:00
Modified
2024-08-08 00:39
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/18441 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=110295781828323&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.exaprobe.com/labs/advisories/esa-2004-1213.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:39:01.047Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-command-execute(18441)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-command-execute(18441)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1148",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-command-execute(18441)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"name": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html",
"refsource": "MISC",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1148",
"datePublished": "2004-12-15T05:00:00",
"dateReserved": "2004-12-06T00:00:00",
"dateUpdated": "2024-08-08T00:39:01.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-1190
Vulnerability from cvelistv5
Published
2012-05-03 01:00
Modified
2024-08-06 18:53
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2012:050 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securityfocus.com/bid/52857 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/75304 | vdb-entry, x_refsource_XF | |
| https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:53:36.372Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php"
},
{
"name": "FEDORA-2012-5599",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "MDVSA-2012:050",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"name": "52857",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52857"
},
{
"name": "phpmyadmin-replication-xss(75304)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75304"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-02-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-17T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php"
},
{
"name": "FEDORA-2012-5599",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "MDVSA-2012:050",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"name": "52857",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52857"
},
{
"name": "phpmyadmin-replication-xss(75304)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75304"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1190",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php"
},
{
"name": "FEDORA-2012-5599",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "MDVSA-2012:050",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"name": "52857",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52857"
},
{
"name": "phpmyadmin-replication-xss(75304)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75304"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1190",
"datePublished": "2012-05-03T01:00:00",
"dateReserved": "2012-02-17T00:00:00",
"dateUpdated": "2024-08-06T18:53:36.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-19617
Vulnerability from cvelistv5
Published
2019-12-06 02:45
Modified
2024-08-05 02:25
Severity ?
EPSS score ?
Summary
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/ | x_refsource_MISC | |
| https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2 | x_refsource_MISC | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9 | x_refsource_MISC | |
| https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:25:12.012Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"name": "[debian-lts-announce] 20191208 [SECURITY] [DLA 2024-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-25T13:06:11",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"name": "[debian-lts-announce] 20191208 [SECURITY] [DLA 2024-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-19617",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"name": "[debian-lts-announce] 20191208 [SECURITY] [DLA 2024-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-19617",
"datePublished": "2019-12-06T02:45:14",
"dateReserved": "2019-12-06T00:00:00",
"dateUpdated": "2024-08-05T02:25:12.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2245
Vulnerability from cvelistv5
Published
2007-04-25 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/33898 | vdb-entry, x_refsource_XF | |
| http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2007/1508 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/26733 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.us.debian.org/security/2007/dsa-1370 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA | |
| http://secunia.com/advisories/24952 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/35050 | vdb-entry, x_refsource_OSVDB | |
| http://www.phpmyadmin.net/ChangeLog.txt | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:27.553Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-fieldkey-xss(33898)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33898"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-1508",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1508"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "24952",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24952"
},
{
"name": "35050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35050"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/ChangeLog.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-fieldkey-xss(33898)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33898"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-1508",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1508"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "24952",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24952"
},
{
"name": "35050",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35050"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/ChangeLog.txt"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2245",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-fieldkey-xss(33898)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33898"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-1508",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1508"
},
{
"name": "26733",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26733"
},
{
"name": "DSA-1370",
"refsource": "DEBIAN",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "24952",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24952"
},
{
"name": "35050",
"refsource": "OSVDB",
"url": "http://osvdb.org/35050"
},
{
"name": "http://www.phpmyadmin.net/ChangeLog.txt",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/ChangeLog.txt"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2245",
"datePublished": "2007-04-25T16:00:00",
"dateReserved": "2007-04-25T00:00:00",
"dateUpdated": "2024-08-07T13:33:27.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6607
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/93257 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-30 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.526Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "93257",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/93257"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-30"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "93257",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/93257"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-30"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6607",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "93257",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/93257"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-30",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-30"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6607",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-5469
Vulnerability from cvelistv5
Published
2012-12-20 11:00
Modified
2024-09-17 00:40
Severity ?
EPSS score ?
Summary
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
References
| ▼ | URL | Tags |
|---|---|---|
| http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/ | x_refsource_MISC | |
| http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:47.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/"
},
{
"name": "20121212 \u0027portable-phpMyAdmin (WordPress Plugin)\u0027 Authentication Bypass (CVE-2012-5469)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-20T11:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/"
},
{
"name": "20121212 \u0027portable-phpMyAdmin (WordPress Plugin)\u0027 Authentication Bypass (CVE-2012-5469)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5469",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/",
"refsource": "MISC",
"url": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/"
},
{
"name": "20121212 \u0027portable-phpMyAdmin (WordPress Plugin)\u0027 Authentication Bypass (CVE-2012-5469)",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5469",
"datePublished": "2012-12-20T11:00:00Z",
"dateReserved": "2012-10-24T00:00:00Z",
"dateUpdated": "2024-09-17T00:40:45.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-12616
Vulnerability from cvelistv5
Published
2019-06-05 04:27
Modified
2024-08-04 23:24
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/ | x_refsource_MISC | |
| https://www.phpmyadmin.net/security/PMASA-2019-4/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/108619 | vdb-entry, x_refsource_BID | |
| http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html | x_refsource_MISC | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST | |
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:24:39.192Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
},
{
"name": "108619",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108619"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"name": "openSUSE-SU-2019:1689",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken \u003cimg\u003e tag pointing at the victim\u0027s phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-14T08:06:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
},
{
"name": "108619",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108619"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"name": "openSUSE-SU-2019:1689",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-12616",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken \u003cimg\u003e tag pointing at the victim\u0027s phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2019-4/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
},
{
"name": "108619",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108619"
},
{
"name": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"name": "openSUSE-SU-2019:1689",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-12616",
"datePublished": "2019-06-05T04:27:12",
"dateReserved": "2019-06-03T00:00:00",
"dateUpdated": "2024-08-04T23:24:39.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-3903
Vulnerability from cvelistv5
Published
2015-05-26 15:00
Modified
2024-08-06 05:56
Severity ?
EPSS score ?
Summary
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/74660 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/archive/1/535547/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html | x_refsource_MISC | |
| http://cxsecurity.com/issue/WLB-2015050095 | x_refsource_MISC | |
| http://www.securitytracker.com/id/1032403 | vdb-entry, x_refsource_SECTRACK | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:56:16.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4"
},
{
"name": "74660",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74660"
},
{
"name": "20150514 phpMyAdmin 4.4.6 Man-In-the-Middle API Github",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/535547/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://cxsecurity.com/issue/WLB-2015050095"
},
{
"name": "1032403",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032403"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4"
},
{
"name": "74660",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74660"
},
{
"name": "20150514 phpMyAdmin 4.4.6 Man-In-the-Middle API Github",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/535547/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://cxsecurity.com/issue/WLB-2015050095"
},
{
"name": "1032403",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032403"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3903",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2015:1191",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4"
},
{
"name": "74660",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74660"
},
{
"name": "20150514 phpMyAdmin 4.4.6 Man-In-the-Middle API Github",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/535547/100/0/threaded"
},
{
"name": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html"
},
{
"name": "http://cxsecurity.com/issue/WLB-2015050095",
"refsource": "MISC",
"url": "http://cxsecurity.com/issue/WLB-2015050095"
},
{
"name": "1032403",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032403"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3903",
"datePublished": "2015-05-26T15:00:00",
"dateReserved": "2015-05-12T00:00:00",
"dateUpdated": "2024-08-06T05:56:16.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2039
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:49.952Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2039",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813"
},
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2039",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:49.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-11768
Vulnerability from cvelistv5
Published
2019-06-05 04:25
Modified
2024-08-04 23:03
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2019-3/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/108617 | vdb-entry, x_refsource_BID | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:03:32.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
},
{
"name": "108617",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108617"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "openSUSE-SU-2019:1689",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-14T08:06:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
},
{
"name": "108617",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108617"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "openSUSE-SU-2019:1689",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11768",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2019-3/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
},
{
"name": "108617",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108617"
},
{
"name": "FEDORA-2019-13d2ba0aed",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"name": "FEDORA-2019-33649e2e64",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"name": "openSUSE-SU-2019:1689",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"name": "openSUSE-SU-2019:1861",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11768",
"datePublished": "2019-06-05T04:25:10",
"dateReserved": "2019-05-06T00:00:00",
"dateUpdated": "2024-08-04T23:03:32.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6374
Vulnerability from cvelistv5
Published
2006-12-07 17:00
Modified
2024-08-07 20:26
Severity ?
EPSS score ?
Summary
Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/453432/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/30703 | vdb-entry, x_refsource_XF | |
| http://securityreason.com/securityalert/1993 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:26:46.360Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "phpmyadmin-multiple-response-splitting(30703)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30703"
},
{
"name": "1993",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1993"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "phpmyadmin-multiple-response-splitting(30703)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30703"
},
{
"name": "1993",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1993"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6374",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "phpmyadmin-multiple-response-splitting(30703)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30703"
},
{
"name": "1993",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1993"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6374",
"datePublished": "2006-12-07T17:00:00",
"dateReserved": "2006-12-07T00:00:00",
"dateUpdated": "2024-08-07T20:26:46.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2040
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.118Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2040",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2040",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:50.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5097
Vulnerability from cvelistv5
Published
2016-07-05 01:00
Modified
2024-08-06 00:53
Severity ?
EPSS score ?
Summary
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-14 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securitytracker.com/id/1035978 | vdb-entry, x_refsource_SECTRACK | |
| https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:53:47.995Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-14"
},
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"name": "1035978",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035978"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-05-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-01T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-14"
},
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"name": "1035978",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035978"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5097",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-14",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-14"
},
{
"name": "openSUSE-SU-2016:1556",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"name": "1035978",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035978"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5097",
"datePublished": "2016-07-05T01:00:00",
"dateReserved": "2016-05-26T00:00:00",
"dateUpdated": "2024-08-06T00:53:47.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-1940
Vulnerability from cvelistv5
Published
2012-01-26 15:00
Modified
2024-08-06 22:46
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.debian.org/security/2012/dsa-2391 | vendor-advisory, x_refsource_DEBIAN | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287 | x_refsource_CONFIRM | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d4088130637d8dee918492 | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:46:00.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d4088130637d8dee918492"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-05-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-11-06T10:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d4088130637d8dee918492"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-1940",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2391",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=7e10c132a3887c8ebfd7a8eee356b28375f1e287",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=7e10c132a3887c8ebfd7a8eee356b28375f1e287"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=d3ccf798fdbd4f8a89d4088130637d8dee918492",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=d3ccf798fdbd4f8a89d4088130637d8dee918492"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1940",
"datePublished": "2012-01-26T15:00:00",
"dateReserved": "2011-05-09T00:00:00",
"dateUpdated": "2024-08-06T22:46:00.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2642
Vulnerability from cvelistv5
Published
2011-08-01 19:00
Modified
2024-08-06 23:08
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.729Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45365"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725381"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php"
},
{
"name": "phpmyadmin-table-print-xss(68750)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68750"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-07-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45365"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725381"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php"
},
{
"name": "phpmyadmin-table-print-xss(68750)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68750"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-2642",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45515",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45365"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=725381",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725381"
},
{
"name": "48874",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=a0823be05aa5835f207c0838b9cca67d2d9a050a",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=a0823be05aa5835f207c0838b9cca67d2d9a050a"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=4bd27166c314faa37cada91533b86377f4d4d214",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=4bd27166c314faa37cada91533b86377f4d4d214"
},
{
"name": "DSA-2286",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "FEDORA-2011-9725",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "FEDORA-2011-9734",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "45315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45315"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php"
},
{
"name": "phpmyadmin-table-print-xss(68750)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68750"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-2642",
"datePublished": "2011-08-01T19:00:00",
"dateReserved": "2011-07-06T00:00:00",
"dateUpdated": "2024-08-06T23:08:23.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1804
Vulnerability from cvelistv5
Published
2006-04-18 10:00
Modified
2024-08-07 17:27
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/1372 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/19659 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/431013/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25858 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/19897 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.novell.com/linux/security/advisories/2006_04_28.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:27:29.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-1372",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "phpmyadmin-sql-sql-injection(25858)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25858"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-04-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-1372",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "phpmyadmin-sql-sql-injection(25858)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25858"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1804",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-1372",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "phpmyadmin-sql-sql-injection(25858)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25858"
},
{
"name": "19897",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1804",
"datePublished": "2006-04-18T10:00:00",
"dateReserved": "2006-04-17T00:00:00",
"dateUpdated": "2024-08-07T17:27:29.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4955
Vulnerability from cvelistv5
Published
2014-07-20 10:00
Modified
2024-08-06 11:34
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/68799 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1 | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:34:36.563Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "68799",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68799"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-04-29T18:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "68799",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68799"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4955",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "68799",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68799"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4955",
"datePublished": "2014-07-20T10:00:00",
"dateReserved": "2014-07-14T00:00:00",
"dateUpdated": "2024-08-06T11:34:36.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2418
Vulnerability from cvelistv5
Published
2006-05-16 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/20627 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.debian.org/security/2006/dsa-1207 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/22781 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26441 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/17973 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2006/1794 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/20113 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.413Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2006:013",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20627"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-db-xss(26441)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26441"
},
{
"name": "17973",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2006:013",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20627"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-db-xss(26441)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26441"
},
{
"name": "17973",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2418",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2006:013",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20627"
},
{
"name": "DSA-1207",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-db-xss(26441)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26441"
},
{
"name": "17973",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20113"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2418",
"datePublished": "2006-05-16T10:00:00",
"dateReserved": "2006-05-15T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0544
Vulnerability from cvelistv5
Published
2005-02-24 05:00
Modified
2024-08-07 21:21
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/14382 | third-party-advisory, x_refsource_SECUNIA | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:21:05.461Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-03-09T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0544",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "14382",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14382"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "GLSA-200503-07",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0544",
"datePublished": "2005-02-24T05:00:00",
"dateReserved": "2005-02-24T00:00:00",
"dateUpdated": "2024-08-07T21:21:05.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3646
Vulnerability from cvelistv5
Published
2011-11-17 19:00
Modified
2024-09-17 01:11
Severity ?
EPSS score ?
Summary
phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html | vendor-advisory, x_refsource_FEDORA | |
| http://secunia.com/advisories/46874 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:158 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:37:48.688Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php"
},
{
"name": "FEDORA-2011-15460",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-17T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php"
},
{
"name": "FEDORA-2011-15460",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3646",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php"
},
{
"name": "FEDORA-2011-15460",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3646",
"datePublished": "2011-11-17T19:00:00Z",
"dateReserved": "2011-09-23T00:00:00Z",
"dateUpdated": "2024-09-17T01:11:17.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5001
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-09-16 22:14
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.212Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-30T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5001",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5001",
"datePublished": "2013-07-30T18:00:00Z",
"dateReserved": "2013-07-29T00:00:00Z",
"dateUpdated": "2024-09-16T22:14:41.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3301
Vulnerability from cvelistv5
Published
2005-10-24 04:00
Modified
2024-08-07 23:10
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.novell.com/linux/security/advisories/2005_28_sr.html | vendor-advisory, x_refsource_SUSE | |
| http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/17607 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/17559 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2005/2179 | vdb-entry, x_refsource_VUPEN | |
| http://www.debian.org/security/2005/dsa-880 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/17337 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml | vendor-advisory, x_refsource_GENTOO | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/15196 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:10:07.520Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17559"
},
{
"name": "ADV-2005-2179",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2179"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "GLSA-200510-21",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "15196",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15196"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-04T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17559"
},
{
"name": "ADV-2005-2179",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2179"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "GLSA-200510-21",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "15196",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15196"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3301",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2005:028",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17559"
},
{
"name": "ADV-2005-2179",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2179"
},
{
"name": "DSA-880",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17337"
},
{
"name": "GLSA-200510-21",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "15196",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15196"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3301",
"datePublished": "2005-10-24T04:00:00",
"dateReserved": "2005-10-23T00:00:00",
"dateUpdated": "2024-08-07T23:10:07.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1258
Vulnerability from cvelistv5
Published
2006-03-19 01:00
Modified
2024-08-07 17:03
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/17142 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25305 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2006/0991 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1015776 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/19277 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/23943 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:03:28.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "17142",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17142"
},
{
"name": "phpmyadmin-settheme-xss(25305)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25305"
},
{
"name": "ADV-2006-0991",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/0991"
},
{
"name": "1015776",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015776"
},
{
"name": "19277",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19277"
},
{
"name": "23943",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/23943"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-03-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "17142",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17142"
},
{
"name": "phpmyadmin-settheme-xss(25305)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25305"
},
{
"name": "ADV-2006-0991",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/0991"
},
{
"name": "1015776",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015776"
},
{
"name": "19277",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19277"
},
{
"name": "23943",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/23943"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1258",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "17142",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17142"
},
{
"name": "phpmyadmin-settheme-xss(25305)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25305"
},
{
"name": "ADV-2006-0991",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/0991"
},
{
"name": "1015776",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015776"
},
{
"name": "19277",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19277"
},
{
"name": "23943",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/23943"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1258",
"datePublished": "2006-03-19T01:00:00",
"dateReserved": "2006-03-18T00:00:00",
"dateUpdated": "2024-08-07T17:03:28.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-4481
Vulnerability from cvelistv5
Published
2010-12-17 18:00
Modified
2024-08-07 03:51
Severity ?
EPSS score ?
Summary
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2011/0027 | vdb-entry, x_refsource_VUPEN | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2011/0001 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/42485 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.debian.org/security/2010/dsa-2139 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.vupen.com/english/advisories/2010/3238 | vdb-entry, x_refsource_VUPEN | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/42725 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:16.859Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2011-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "42485",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "ADV-2010-3238",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/3238"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-01-11T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2011-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "42485",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "ADV-2010-3238",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/3238"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4481",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2011-0027",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=4d9fd005671b05c4d74615d5939ed45e4d019e4c",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=4d9fd005671b05c4d74615d5939ed45e4d019e4c"
},
{
"name": "ADV-2011-0001",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "42485",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "ADV-2010-3238",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/3238"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php"
},
{
"name": "42725",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4481",
"datePublished": "2010-12-17T18:00:00",
"dateReserved": "2010-12-07T00:00:00",
"dateUpdated": "2024-08-07T03:51:16.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6626
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-49 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/92490 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.415Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-49"
},
{
"name": "92490",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92490"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-49"
},
{
"name": "92490",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92490"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6626",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-49",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-49"
},
{
"name": "92490",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92490"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6626",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-22452
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2024-08-04 14:51
Severity ?
EPSS score ?
Summary
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:51:10.764Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://phpmyadmin.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/15898"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/pull/16004"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-27T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://phpmyadmin.com"
},
{
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/15898"
},
{
"url": "https://github.com/phpmyadmin/phpmyadmin/pull/16004"
},
{
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-22452",
"datePublished": "2023-01-26T00:00:00",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:51:10.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6619
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95048 | vdb-entry, x_refsource_BID | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://www.phpmyadmin.net/security/PMASA-2016-42 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95048",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95048"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-42"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95048",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95048"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-42"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6619",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95048",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95048"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-42",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-42"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6619",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6606
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-29 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94114 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-29"
},
{
"name": "94114",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94114"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user\u0027s browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-29"
},
{
"name": "94114",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94114"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6606",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user\u0027s browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-29",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-29"
},
{
"name": "94114",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94114"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6606",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-4219
Vulnerability from cvelistv5
Published
2012-08-21 19:00
Modified
2024-08-06 20:28
Severity ?
EPSS score ?
Summary
show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php | x_refsource_CONFIRM | |
| https://hermes.opensuse.org/messages/15513071 | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:28:07.680Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php"
},
{
"name": "openSUSE-SU-2012:1062",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-09-07T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php"
},
{
"name": "openSUSE-SU-2012:1062",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4219",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php"
},
{
"name": "openSUSE-SU-2012:1062",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15513071"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4219",
"datePublished": "2012-08-21T19:00:00",
"dateReserved": "2012-08-08T00:00:00",
"dateUpdated": "2024-08-06T20:28:07.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4996
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-08-06 16:59
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/59832 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/61921 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.182Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61921",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61921"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61921",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61921"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4996",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"name": "59832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61921",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61921"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4996",
"datePublished": "2013-07-30T18:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:41.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4987
Vulnerability from cvelistv5
Published
2014-07-20 10:00
Modified
2024-08-06 11:34
Severity ?
EPSS score ?
Summary
server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/68804 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:34:37.188Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
},
{
"name": "68804",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68804"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
},
{
"name": "68804",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68804"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4987",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
},
{
"name": "68804",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68804"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4987",
"datePublished": "2014-07-20T10:00:00",
"dateReserved": "2014-07-16T00:00:00",
"dateUpdated": "2024-08-06T11:34:37.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9856
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94530 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-64 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.553Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94530",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94530",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9856",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94530",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94530"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-64",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9856",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-6798
Vulnerability from cvelistv5
Published
2019-01-26 17:00
Modified
2024-08-04 20:31
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/106727 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2019-2/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:31:04.103Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "106727",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106727"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-01-28T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "106727",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106727"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-6798",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106727",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106727"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2019-2/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-6798",
"datePublished": "2019-01-26T17:00:00",
"dateReserved": "2019-01-24T00:00:00",
"dateUpdated": "2024-08-04T20:31:04.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5098
Vulnerability from cvelistv5
Published
2016-07-05 01:00
Modified
2024-08-06 00:53
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html | vendor-advisory, x_refsource_SUSE | |
| https://www.phpmyadmin.net/security/PMASA-2016-15 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1035980 | vdb-entry, x_refsource_SECTRACK | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:53:47.321Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8"
},
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-15"
},
{
"name": "1035980",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035980"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-05-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-01T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8"
},
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-15"
},
{
"name": "1035980",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035980"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8"
},
{
"name": "openSUSE-SU-2016:1556",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-15",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-15"
},
{
"name": "1035980",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035980"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5098",
"datePublished": "2016-07-05T01:00:00",
"dateReserved": "2016-05-26T00:00:00",
"dateUpdated": "2024-08-06T00:53:47.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-1902
Vulnerability from cvelistv5
Published
2012-04-06 19:00
Modified
2024-08-06 19:17
Severity ?
EPSS score ?
Summary
show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securityfocus.com/bid/52858 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4 | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2012:050 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/74608 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.009Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2012-5599",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "52858",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52858"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4"
},
{
"name": "MDVSA-2012:050",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php"
},
{
"name": "phpmyadmin-showconfigerrors-path-disclosure(74608)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74608"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-03-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-17T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2012-5599",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "52858",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52858"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4"
},
{
"name": "MDVSA-2012:050",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php"
},
{
"name": "phpmyadmin-showconfigerrors-path-disclosure(74608)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74608"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1902",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2012-5599",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"name": "FEDORA-2012-5631",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"name": "52858",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52858"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4"
},
{
"name": "MDVSA-2012:050",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"name": "FEDORA-2012-5624",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php"
},
{
"name": "phpmyadmin-showconfigerrors-path-disclosure(74608)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74608"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1902",
"datePublished": "2012-04-06T19:00:00",
"dateReserved": "2012-03-26T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3621
Vulnerability from cvelistv5
Published
2005-11-16 11:00
Modified
2024-08-07 23:17
Severity ?
EPSS score ?
Summary
CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.novell.com/linux/security/advisories/2005_28_sr.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/17578 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.debian.org/security/2006/dsa-1207 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/22781 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1015213 | vdb-entry, x_refsource_SECTRACK | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:17:23.601Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "17578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17578"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "1015213",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015213"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-24T10:00:00",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "17578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17578"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "1015213",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015213"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2005-3621",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2005:028",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "17578",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17578"
},
{
"name": "DSA-1207",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22781"
},
{
"name": "1015213",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015213"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2005-3621",
"datePublished": "2005-11-16T11:00:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-07T23:17:23.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000013
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2017-1 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95720 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:05.838Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-1"
},
{
"name": "95720",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95720"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-27T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-1"
},
{
"name": "95720",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95720"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.265596",
"ID": "CVE-2017-1000013",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-1",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-1"
},
{
"name": "95720",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95720"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000013",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:05.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2016
Vulnerability from cvelistv5
Published
2007-04-12 19:00
Modified
2024-08-07 13:13
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/465082/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2560 | third-party-advisory, x_refsource_SREASON | |
| http://osvdb.org/35049 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:13:42.002Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20070408 phpMyAdmin 2.6.1 Local Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/465082/100/0/threaded"
},
{
"name": "2560",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2560"
},
{
"name": "35049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35049"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20070408 phpMyAdmin 2.6.1 Local Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/465082/100/0/threaded"
},
{
"name": "2560",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2560"
},
{
"name": "35049",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35049"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2016",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20070408 phpMyAdmin 2.6.1 Local Cross Site Scripting",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/465082/100/0/threaded"
},
{
"name": "2560",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2560"
},
{
"name": "35049",
"refsource": "OSVDB",
"url": "http://osvdb.org/35049"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2016",
"datePublished": "2007-04-12T19:00:00",
"dateReserved": "2007-04-12T00:00:00",
"dateUpdated": "2024-08-07T13:13:42.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000014
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2017-3 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95721 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:05.869Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-3"
},
{
"name": "95721",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95721"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-27T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-3"
},
{
"name": "95721",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95721"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.266410",
"ID": "CVE-2017-1000014",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-3",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-3"
},
{
"name": "95721",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95721"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000014",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:05.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4348
Vulnerability from cvelistv5
Published
2014-06-25 10:00
Modified
2024-08-06 11:12
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838 | x_refsource_CONFIRM | |
| http://phpmyadmin.net/home_page/security/PMASA-2014-2.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/68201 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:12:35.395Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e"
},
{
"name": "68201",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68201"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-01T14:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e"
},
{
"name": "68201",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68201"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4348",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838"
},
{
"name": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e"
},
{
"name": "68201",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68201"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4348",
"datePublished": "2014-06-25T10:00:00",
"dateReserved": "2014-06-20T00:00:00",
"dateUpdated": "2024-08-06T11:12:35.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3263
Vulnerability from cvelistv5
Published
2010-09-10 19:00
Modified
2024-08-07 03:03
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2010:186 | vendor-advisory, x_refsource_MANDRIVA | |
| http://secunia.com/advisories/41210 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/61675 | vdb-entry, x_refsource_XF | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:03:18.673Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2010:186",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:186"
},
{
"name": "41210",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41210"
},
{
"name": "phpmyadmin-uns-xss(61675)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61675"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-09-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2010:186",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:186"
},
{
"name": "41210",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41210"
},
{
"name": "phpmyadmin-uns-xss(61675)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61675"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3263",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2010:186",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:186"
},
{
"name": "41210",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41210"
},
{
"name": "phpmyadmin-uns-xss(61675)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61675"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3263",
"datePublished": "2010-09-10T19:00:00",
"dateReserved": "2010-09-08T00:00:00",
"dateUpdated": "2024-08-07T03:03:18.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-8669
Vulnerability from cvelistv5
Published
2015-12-26 22:00
Modified
2024-08-06 08:29
Severity ?
EPSS score ?
Summary
libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html | vendor-advisory, x_refsource_SUSE | |
| https://www.phpmyadmin.net/security/PMASA-2015-6/ | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1034806 | vdb-entry, x_refsource_SECTRACK | |
| https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:29:20.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:0067",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-6/"
},
{
"name": "1034806",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034806"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-12-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:0067",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-6/"
},
{
"name": "1034806",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034806"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-8669",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0067",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2015-6/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2015-6/"
},
{
"name": "1034806",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034806"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-8669",
"datePublished": "2015-12-26T22:00:00",
"dateReserved": "2015-12-25T00:00:00",
"dateUpdated": "2024-08-06T08:29:20.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-9219
Vulnerability from cvelistv5
Published
2014-12-08 11:00
Modified
2024-08-06 13:40
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:243 | vendor-advisory, x_refsource_MANDRIVA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/99137 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:40:24.436Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php"
},
{
"name": "MDVSA-2014:243",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2"
},
{
"name": "phpmyadmin-cve20149219-xss(99137)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99137"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php"
},
{
"name": "MDVSA-2014:243",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2"
},
{
"name": "phpmyadmin-cve20149219-xss(99137)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99137"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9219",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php"
},
{
"name": "MDVSA-2014:243",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2"
},
{
"name": "phpmyadmin-cve20149219-xss(99137)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99137"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9219",
"datePublished": "2014-12-08T11:00:00",
"dateReserved": "2014-12-02T00:00:00",
"dateUpdated": "2024-08-06T13:40:24.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3388
Vulnerability from cvelistv5
Published
2006-07-06 20:00
Modified
2024-08-07 18:23
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2006/2622 | vdb-entry, x_refsource_VUPEN | |
| http://securityreason.com/securityalert/1194 | third-party-advisory, x_refsource_SREASON | |
| http://securitynews.ir/advisories/phpmyadmin281.txt | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/27493 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/20907 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/438870/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/18754 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/23086 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:23:21.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4"
},
{
"name": "ADV-2006-2622",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2622"
},
{
"name": "1194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1194"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://securitynews.ir/advisories/phpmyadmin281.txt"
},
{
"name": "phpmyadmin-table-xss(27493)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27493"
},
{
"name": "20907",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20907"
},
{
"name": "20060630 phpMyAdmin : Cross-Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/438870/100/0/threaded"
},
{
"name": "18754",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/18754"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-06-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4"
},
{
"name": "ADV-2006-2622",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2622"
},
{
"name": "1194",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1194"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://securitynews.ir/advisories/phpmyadmin281.txt"
},
{
"name": "phpmyadmin-table-xss(27493)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27493"
},
{
"name": "20907",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20907"
},
{
"name": "20060630 phpMyAdmin : Cross-Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/438870/100/0/threaded"
},
{
"name": "18754",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/18754"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3388",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4"
},
{
"name": "ADV-2006-2622",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2622"
},
{
"name": "1194",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1194"
},
{
"name": "http://securitynews.ir/advisories/phpmyadmin281.txt",
"refsource": "MISC",
"url": "http://securitynews.ir/advisories/phpmyadmin281.txt"
},
{
"name": "phpmyadmin-table-xss(27493)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27493"
},
{
"name": "20907",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20907"
},
{
"name": "20060630 phpMyAdmin : Cross-Site Scripting Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/438870/100/0/threaded"
},
{
"name": "18754",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/18754"
},
{
"name": "23086",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3388",
"datePublished": "2006-07-06T20:00:00",
"dateReserved": "2006-07-06T00:00:00",
"dateUpdated": "2024-08-07T18:23:21.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-1941
Vulnerability from cvelistv5
Published
2012-01-26 15:00
Modified
2024-09-16 17:08
Severity ?
EPSS score ?
Summary
Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:46:00.277Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-01-26T15:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-1941",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-1941",
"datePublished": "2012-01-26T15:00:00Z",
"dateReserved": "2011-05-09T00:00:00Z",
"dateUpdated": "2024-09-16T17:08:15.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4954
Vulnerability from cvelistv5
Published
2014-07-20 10:00
Modified
2024-08-06 11:34
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/68798 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:34:37.234Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php"
},
{
"name": "68798",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68798"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-04-29T18:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php"
},
{
"name": "68798",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68798"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4954",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php"
},
{
"name": "68798",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68798"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4954",
"datePublished": "2014-07-20T10:00:00",
"dateReserved": "2014-07-14T00:00:00",
"dateUpdated": "2024-08-06T11:34:37.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2718
Vulnerability from cvelistv5
Published
2011-08-01 19:00
Modified
2024-08-06 23:08
Severity ?
EPSS score ?
Summary
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.701Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "74111",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/74111"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "[oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725383"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "phpmyadmin-schema-file-include(68768)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68768"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "[oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-07-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "74111",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/74111"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "[oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725383"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "phpmyadmin-schema-file-include(68768)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68768"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "[oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2718",
"datePublished": "2011-08-01T19:00:00",
"dateReserved": "2011-07-11T00:00:00",
"dateUpdated": "2024-08-06T23:08:23.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9863
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94526 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-68 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.637Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94526",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94526"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-68"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94526",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94526"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-68"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9863",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94526",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94526"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-68",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-68"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9863",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6622
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-45 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/95049 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.416Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-45"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95049",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95049"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-45"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95049",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95049"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-45",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-45"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95049",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95049"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6622",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-2417
Vulnerability from cvelistv5
Published
2006-05-16 10:00
Modified
2024-08-07 17:51
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/20627 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/26444 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/17973 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2006/1794 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/20113 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:51:04.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2006:013",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20627"
},
{
"name": "phpmyadmin-theme-parameter-xss(26444)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26444"
},
{
"name": "17973",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20113"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2006:013",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20627"
},
{
"name": "phpmyadmin-theme-parameter-xss(26444)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26444"
},
{
"name": "17973",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20113"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2417",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2006:013",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"name": "20627",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20627"
},
{
"name": "phpmyadmin-theme-parameter-xss(26444)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26444"
},
{
"name": "17973",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17973"
},
{
"name": "ADV-2006-1794",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"name": "20113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20113"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2417",
"datePublished": "2006-05-16T10:00:00",
"dateReserved": "2006-05-15T00:00:00",
"dateUpdated": "2024-08-07T17:51:04.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9866
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 03:07
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94536 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-71 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:07:30.178Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94536",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94536"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. When the arg_separator is different from its default \u0026 value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94536",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94536"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9866",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. When the arg_separator is different from its default \u0026 value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94536",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94536"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-71",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9866",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T03:07:30.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-1325
Vulnerability from cvelistv5
Published
2007-03-07 21:00
Modified
2024-08-07 12:50
Severity ?
EPSS score ?
Summary
The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.php.net/releases/4_4_8.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/26733 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22841 | vdb-entry, x_refsource_BID | |
| http://www.us.debian.org/security/2007/dsa-1370 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3 | x_refsource_CONFIRM | |
| http://www.php.net/ChangeLog-4.php | x_refsource_CONFIRM | |
| http://osvdb.org/36834 | vdb-entry, x_refsource_OSVDB | |
| http://www.php-security.org/MOPB/MOPB-02-2007.html | x_refsource_MISC | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1671813&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2007/0831 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:50:34.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php.net/releases/4_4_8.php"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "22841",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22841"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.php.net/ChangeLog-4.php"
},
{
"name": "36834",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/36834"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.php-security.org/MOPB/MOPB-02-2007.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2007-0831",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0831"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-14T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php.net/releases/4_4_8.php"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "22841",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22841"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.php.net/ChangeLog-4.php"
},
{
"name": "36834",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/36834"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.php-security.org/MOPB/MOPB-02-2007.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2007-0831",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0831"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1325",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.php.net/releases/4_4_8.php",
"refsource": "CONFIRM",
"url": "http://www.php.net/releases/4_4_8.php"
},
{
"name": "26733",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26733"
},
{
"name": "22841",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22841"
},
{
"name": "DSA-1370",
"refsource": "DEBIAN",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3"
},
{
"name": "http://www.php.net/ChangeLog-4.php",
"refsource": "CONFIRM",
"url": "http://www.php.net/ChangeLog-4.php"
},
{
"name": "36834",
"refsource": "OSVDB",
"url": "http://osvdb.org/36834"
},
{
"name": "http://www.php-security.org/MOPB/MOPB-02-2007.html",
"refsource": "MISC",
"url": "http://www.php-security.org/MOPB/MOPB-02-2007.html"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2007-0831",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0831"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1325",
"datePublished": "2007-03-07T21:00:00",
"dateReserved": "2007-03-07T00:00:00",
"dateUpdated": "2024-08-07T12:50:34.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6612
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-35 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94113 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.475Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-35"
},
{
"name": "94113",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94113"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-35"
},
{
"name": "94113",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94113"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6612",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-35",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-35"
},
{
"name": "94113",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94113"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6612",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3055
Vulnerability from cvelistv5
Published
2010-08-24 19:00
Modified
2024-08-07 02:55
Severity ?
EPSS score ?
Summary
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/42591 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/41058 | third-party-advisory, x_refsource_SECUNIA | |
| http://sourceforge.net/tracker/?func=detail&aid=3045132&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/2231 | vdb-entry, x_refsource_VUPEN | |
| http://www.debian.org/security/2010/dsa-2097 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2010:163 | vendor-advisory, x_refsource_MANDRIVA | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/2223 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/41185 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:46.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "42591",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/42591"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php"
},
{
"name": "41058",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41058"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2010-2231",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"name": "MDVSA-2010:163",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2"
},
{
"name": "ADV-2010-2223",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41185"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-08-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-09-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "42591",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/42591"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php"
},
{
"name": "41058",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41058"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2010-2231",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"name": "MDVSA-2010:163",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2"
},
{
"name": "ADV-2010-2223",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41185"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3055",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "42591",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/42591"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php"
},
{
"name": "41058",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41058"
},
{
"name": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408"
},
{
"name": "ADV-2010-2231",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"name": "MDVSA-2010:163",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2"
},
{
"name": "ADV-2010-2223",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41185"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3055",
"datePublished": "2010-08-24T19:00:00",
"dateReserved": "2010-08-19T00:00:00",
"dateUpdated": "2024-08-07T02:55:46.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2561
Vulnerability from cvelistv5
Published
2016-03-01 11:00
Modified
2024-08-05 23:32
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:32:21.021Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-12/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f"
},
{
"name": "openSUSE-SU-2016:0666",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"name": "openSUSE-SU-2016:0663",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-12/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f"
},
{
"name": "openSUSE-SU-2016:0666",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"name": "openSUSE-SU-2016:0663",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2561",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2016-65da02b95c",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-12/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-12/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372"
},
{
"name": "FEDORA-2016-02ee5b4002",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f"
},
{
"name": "openSUSE-SU-2016:0666",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"name": "openSUSE-SU-2016:0663",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2561",
"datePublished": "2016-03-01T11:00:00",
"dateReserved": "2016-02-25T00:00:00",
"dateUpdated": "2024-08-05T23:32:21.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-8961
Vulnerability from cvelistv5
Published
2014-11-30 11:00
Modified
2024-08-06 13:33
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994 | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:228 | vendor-advisory, x_refsource_MANDRIVA | |
| http://www.securityfocus.com/bid/71245 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:12.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"name": "71245",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71245"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file\u0027s line count via a crafted parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"name": "71245",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71245"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8961",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file\u0027s line count via a crafted parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994"
},
{
"name": "MDVSA-2014:228",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"name": "71245",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71245"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8961",
"datePublished": "2014-11-30T11:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T13:33:12.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-26935
Vulnerability from cvelistv5
Published
2020-10-10 18:26
Modified
2024-08-04 16:03
Severity ?
EPSS score ?
Summary
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:23.118Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-6/"
},
{
"name": "openSUSE-SU-2020:1675",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4281"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-30T21:10:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-6/"
},
{
"name": "openSUSE-SU-2020:1675",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4281"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-26935",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-6/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-6/"
},
{
"name": "openSUSE-SU-2020:1675",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"name": "https://advisory.checkmarx.net/advisory/CX-2020-4281",
"refsource": "MISC",
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4281"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-26935",
"datePublished": "2020-10-10T18:26:53",
"dateReserved": "2020-10-10T00:00:00",
"dateUpdated": "2024-08-04T16:03:23.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9849
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94521 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-60 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.530Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94521",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94521"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-60"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg[\u0027Servers\u0027][$i][\u0027AllowRoot\u0027]) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94521",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94521"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-60"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9849",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg[\u0027Servers\u0027][$i][\u0027AllowRoot\u0027]) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94521",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94521"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-60",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-60"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9849",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3238
Vulnerability from cvelistv5
Published
2013-04-26 01:00
Modified
2024-08-06 16:00
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:00:10.156Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2013:160",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "25136",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/25136"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-6977",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"name": "FEDORA-2013-7000",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\\x00 sequence, which is not properly handled before making a preg_replace function call within the \"Replace table prefix\" feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-05-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2013:160",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "25136",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/25136"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-6977",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"name": "FEDORA-2013-7000",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3238",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\\x00 sequence, which is not properly handled before making a preg_replace function call within the \"Replace table prefix\" feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2013:160",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "FEDORA-2013-6928",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"name": "25136",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/25136"
},
{
"name": "openSUSE-SU-2013:1065",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-6977",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"name": "FEDORA-2013-7000",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549"
},
{
"name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133",
"refsource": "CONFIRM",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3238",
"datePublished": "2013-04-26T01:00:00",
"dateReserved": "2013-04-22T00:00:00",
"dateUpdated": "2024-08-06T16:00:10.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-5273
Vulnerability from cvelistv5
Published
2014-08-22 01:00
Modified
2024-08-06 11:41
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:41:47.716Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-14T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5273",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5273",
"datePublished": "2014-08-22T01:00:00",
"dateReserved": "2014-08-16T00:00:00",
"dateUpdated": "2024-08-06T11:41:47.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2562
Vulnerability from cvelistv5
Published
2016-03-01 11:00
Modified
2024-08-05 23:32
Severity ?
EPSS score ?
Summary
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-13/ | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:32:20.950Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-13/"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-13/"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2562",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2016-65da02b95c",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-13/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-13/"
},
{
"name": "FEDORA-2016-02ee5b4002",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2562",
"datePublished": "2016-03-01T11:00:00",
"dateReserved": "2016-02-25T00:00:00",
"dateUpdated": "2024-08-05T23:32:20.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6608
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-31 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/93258 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.331Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-31"
},
{
"name": "93258",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/93258"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-31"
},
{
"name": "93258",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/93258"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6608",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-31",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-31"
},
{
"name": "93258",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/93258"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6608",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1055
Vulnerability from cvelistv5
Published
2004-11-24 05:00
Modified
2024-08-08 00:39
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.netvigilance.com/html/advisory0005.htm | x_refsource_MISC | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/18158 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:39:00.403Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.netvigilance.com/html/advisory0005.htm"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3"
},
{
"name": "phpmyadmin-multiple-xss(18158)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-11-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.netvigilance.com/html/advisory0005.htm"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3"
},
{
"name": "phpmyadmin-multiple-xss(18158)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1055",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.netvigilance.com/html/advisory0005.htm",
"refsource": "MISC",
"url": "http://www.netvigilance.com/html/advisory0005.htm"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3"
},
{
"name": "phpmyadmin-multiple-xss(18158)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1055",
"datePublished": "2004-11-24T05:00:00",
"dateReserved": "2004-11-19T00:00:00",
"dateUpdated": "2024-08-08T00:39:00.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-6300
Vulnerability from cvelistv5
Published
2014-11-08 11:00
Modified
2024-08-06 12:10
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/69790 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:10:13.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php"
},
{
"name": "openSUSE-SU-2014:1150",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html"
},
{
"name": "69790",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/69790"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-09-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-20T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php"
},
{
"name": "openSUSE-SU-2014:1150",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html"
},
{
"name": "69790",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/69790"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-6300",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php"
},
{
"name": "openSUSE-SU-2014:1150",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html"
},
{
"name": "69790",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/69790"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-6300",
"datePublished": "2014-11-08T11:00:00",
"dateReserved": "2014-09-11T00:00:00",
"dateUpdated": "2024-08-06T12:10:13.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-1924
Vulnerability from cvelistv5
Published
2008-04-23 16:00
Modified
2024-08-07 08:41
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:41:00.230Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "28906",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28906"
},
{
"name": "GLSA-200805-02",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200805-02.xml"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "phpmyadmin-unspecified-info-disclosure(41964)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41964"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "29944",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29944"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3"
},
{
"name": "30034",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30034"
},
{
"name": "ADV-2008-1328",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/1328/references"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-04-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "28906",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28906"
},
{
"name": "GLSA-200805-02",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200805-02.xml"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "phpmyadmin-unspecified-info-disclosure(41964)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41964"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "29944",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29944"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3"
},
{
"name": "30034",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30034"
},
{
"name": "ADV-2008-1328",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/1328/references"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1924",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "28906",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28906"
},
{
"name": "GLSA-200805-02",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200805-02.xml"
},
{
"name": "DSA-1557",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30816"
},
{
"name": "phpmyadmin-unspecified-info-disclosure(41964)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41964"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "29944",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29944"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3"
},
{
"name": "30034",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30034"
},
{
"name": "ADV-2008-1328",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/1328/references"
},
{
"name": "SUSE-SR:2008:026",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1924",
"datePublished": "2008-04-23T16:00:00",
"dateReserved": "2008-04-23T00:00:00",
"dateUpdated": "2024-08-07T08:41:00.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3181
Vulnerability from cvelistv5
Published
2011-08-29 17:00
Modified
2024-08-06 23:22
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/45990 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/45709 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/49306 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2012/dsa-2391 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:158 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html | vendor-advisory, x_refsource_FEDORA | |
| https://bugzilla.redhat.com/show_bug.cgi?id=733475 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:22:27.750Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45990",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45990"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php"
},
{
"name": "45709",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45709"
},
{
"name": "49306",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49306"
},
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "FEDORA-2011-11594",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html"
},
{
"name": "FEDORA-2011-11630",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "FEDORA-2011-11477",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=733475"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-08-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-09-23T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45990",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45990"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php"
},
{
"name": "45709",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45709"
},
{
"name": "49306",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49306"
},
{
"name": "DSA-2391",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "FEDORA-2011-11594",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html"
},
{
"name": "FEDORA-2011-11630",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "FEDORA-2011-11477",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=733475"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3181",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45990",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45990"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php"
},
{
"name": "45709",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45709"
},
{
"name": "49306",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49306"
},
{
"name": "DSA-2391",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"name": "FEDORA-2011-11594",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html"
},
{
"name": "FEDORA-2011-11630",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html"
},
{
"name": "MDVSA-2011:158",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "FEDORA-2011-11477",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=733475",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=733475"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3181",
"datePublished": "2011-08-29T17:00:00",
"dateReserved": "2011-08-19T00:00:00",
"dateUpdated": "2024-08-06T23:22:27.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0341
Vulnerability from cvelistv5
Published
2007-01-18 02:00
Modified
2024-08-07 12:12
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.virtuax.be/advisories/Advisory1-12012007.txt | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/456726/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/456698/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:12:18.175Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.virtuax.be/advisories/Advisory1-12012007.txt"
},
{
"name": "20070112 Re: xss in phpmyadmin \u003c= 2.8.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/456726/100/0/threaded"
},
{
"name": "20070112 xss in phpmyadmin \u003c= 2.8.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/456698/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.virtuax.be/advisories/Advisory1-12012007.txt"
},
{
"name": "20070112 Re: xss in phpmyadmin \u003c= 2.8.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/456726/100/0/threaded"
},
{
"name": "20070112 xss in phpmyadmin \u003c= 2.8.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/456698/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0341",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.virtuax.be/advisories/Advisory1-12012007.txt",
"refsource": "MISC",
"url": "http://www.virtuax.be/advisories/Advisory1-12012007.txt"
},
{
"name": "20070112 Re: xss in phpmyadmin \u003c= 2.8.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/456726/100/0/threaded"
},
{
"name": "20070112 xss in phpmyadmin \u003c= 2.8.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/456698/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0341",
"datePublished": "2007-01-18T02:00:00",
"dateReserved": "2007-01-17T00:00:00",
"dateUpdated": "2024-08-07T12:12:18.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-0986
Vulnerability from cvelistv5
Published
2011-02-14 21:00
Modified
2024-08-06 22:14
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/65424 | vdb-entry, x_refsource_XF | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2011/0385 | vdb-entry, x_refsource_VUPEN | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:026 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/43478 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:26.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-readme-path-disclosure(65424)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83"
},
{
"name": "ADV-2011-0385",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "FEDORA-2011-1408",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "MDVSA-2011:026",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "FEDORA-2011-1373",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php"
},
{
"name": "43478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43478"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-readme-path-disclosure(65424)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83"
},
{
"name": "ADV-2011-0385",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "FEDORA-2011-1408",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "MDVSA-2011:026",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "FEDORA-2011-1373",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php"
},
{
"name": "43478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43478"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0986",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-readme-path-disclosure(65424)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=035d002db1e1201e73e560d7d98591563b506a83",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=035d002db1e1201e73e560d7d98591563b506a83"
},
{
"name": "ADV-2011-0385",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "FEDORA-2011-1408",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "MDVSA-2011:026",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "FEDORA-2011-1373",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php"
},
{
"name": "43478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43478"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0986",
"datePublished": "2011-02-14T21:00:00",
"dateReserved": "2011-02-11T00:00:00",
"dateUpdated": "2024-08-06T22:14:26.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0567
Vulnerability from cvelistv5
Published
2005-02-27 05:00
Modified
2024-08-07 21:21
Severity ?
EPSS score ?
Summary
Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/19465 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/14382/ | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/12645 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1 | x_refsource_CONFIRM | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1149381&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://marc.info/?l=bugtraq&m=110929725801154&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:21:06.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-file-include(19465)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19465"
},
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14382/"
},
{
"name": "12645",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/12645"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-02-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-file-include(19465)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19465"
},
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14382/"
},
{
"name": "12645",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/12645"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0567",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-file-include(19465)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19465"
},
{
"name": "14382",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14382/"
},
{
"name": "12645",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/12645"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0567",
"datePublished": "2005-02-27T05:00:00",
"dateReserved": "2005-02-27T00:00:00",
"dateUpdated": "2024-08-07T21:21:06.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6630
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92501 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-53 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.151Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92501",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92501"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-53"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92501",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92501"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-53"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6630",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92501",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92501"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-53",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-53"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6630",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1937
Vulnerability from cvelistv5
Published
2013-04-16 10:00
Modified
2024-08-06 15:20
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:20:37.451Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2013:144",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:144"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://immunityservices.blogspot.com/2019/02/cvss.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-5623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html"
},
{
"name": "FEDORA-2013-5604",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html"
},
{
"name": "20130409 [waraxe-2013-SA#102] - Reflected XSS in phpMyAdmin 3.5.7",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html"
},
{
"name": "[oss-security] 20130409 Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2013/04/09/13"
},
{
"name": "FEDORA-2013-5620",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-102.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is \"not exploitable."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-11T01:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "MDVSA-2013:144",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:144"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://immunityservices.blogspot.com/2019/02/cvss.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a"
},
{
"name": "openSUSE-SU-2013:1065",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-5623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html"
},
{
"name": "FEDORA-2013-5604",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html"
},
{
"name": "20130409 [waraxe-2013-SA#102] - Reflected XSS in phpMyAdmin 3.5.7",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html"
},
{
"name": "[oss-security] 20130409 Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2013/04/09/13"
},
{
"name": "FEDORA-2013-5620",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-102.html"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-1937",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is \"not exploitable.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2013:144",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:144"
},
{
"name": "http://immunityservices.blogspot.com/2019/02/cvss.html",
"refsource": "MISC",
"url": "http://immunityservices.blogspot.com/2019/02/cvss.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a"
},
{
"name": "openSUSE-SU-2013:1065",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"name": "FEDORA-2013-5623",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html"
},
{
"name": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html"
},
{
"name": "FEDORA-2013-5604",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html"
},
{
"name": "20130409 [waraxe-2013-SA#102] - Reflected XSS in phpMyAdmin 3.5.7",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html"
},
{
"name": "[oss-security] 20130409 Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2013/04/09/13"
},
{
"name": "FEDORA-2013-5620",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php"
},
{
"name": "http://www.waraxe.us/advisory-102.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-102.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-1937",
"datePublished": "2013-04-16T10:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:20:37.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6615
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the "Tracking" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95041 | vdb-entry, x_refsource_BID | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://www.phpmyadmin.net/security/PMASA-2016-38 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.964Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95041",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95041"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-38"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the \"Tracking\" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95041",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95041"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-38"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6615",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the \"Tracking\" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95041",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95041"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-38",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-38"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6615",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-5159
Vulnerability from cvelistv5
Published
2012-09-25 22:00
Modified
2024-08-06 20:58
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/55672 | vdb-entry, x_refsource_BID | |
| http://seclists.org/oss-sec/2012/q3/562 | mailing-list, x_refsource_MLIST | |
| http://sourceforge.net/blog/phpmyadmin-back-door/ | x_refsource_MISC | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:58:03.057Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "55672",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55672"
},
{
"name": "[oss-security] 20120925 Re: CVE Request - phpMyAdmin: PMASA-2012-5 incident",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2012/q3/562"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://sourceforge.net/blog/phpmyadmin-back-door/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-09-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-26T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "55672",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55672"
},
{
"name": "[oss-security] 20120925 Re: CVE Request - phpMyAdmin: PMASA-2012-5 incident",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2012/q3/562"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://sourceforge.net/blog/phpmyadmin-back-door/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5159",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "55672",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55672"
},
{
"name": "[oss-security] 20120925 Re: CVE Request - phpMyAdmin: PMASA-2012-5 incident",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2012/q3/562"
},
{
"name": "http://sourceforge.net/blog/phpmyadmin-back-door/",
"refsource": "MISC",
"url": "http://sourceforge.net/blog/phpmyadmin-back-door/"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5159",
"datePublished": "2012-09-25T22:00:00",
"dateReserved": "2012-09-25T00:00:00",
"dateUpdated": "2024-08-06T20:58:03.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5704
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-20/ | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.564Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-20/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-20/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5704",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-20/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-20/"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5704",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-4605
Vulnerability from cvelistv5
Published
2010-01-19 16:00
Modified
2024-08-07 07:08
Severity ?
EPSS score ?
Summary
scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php | x_refsource_CONFIRM | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149&r2=13148&pathrev=13149 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/38211 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/39503 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html | vendor-advisory, x_refsource_SUSE | |
| http://www.vupen.com/english/advisories/2010/0910 | vdb-entry, x_refsource_VUPEN | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=13149 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2010/dsa-2034 | vendor-advisory, x_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:08:38.133Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149"
},
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-01-28T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149"
},
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-4605",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149"
},
{
"name": "38211",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "ADV-2010-0910",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149"
},
{
"name": "DSA-2034",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2034"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-4605",
"datePublished": "2010-01-19T16:00:00",
"dateReserved": "2010-01-12T00:00:00",
"dateUpdated": "2024-08-07T07:08:38.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-15605
Vulnerability from cvelistv5
Published
2018-08-24 19:00
Modified
2024-08-05 10:01
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/105168 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1041548 | vdb-entry, x_refsource_SECTRACK | |
| https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2018-5/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:01:54.548Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "105168",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/105168"
},
{
"name": "1041548",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041548"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-5/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-08-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-08-30T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "105168",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/105168"
},
{
"name": "1041548",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041548"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-5/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-15605",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "105168",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/105168"
},
{
"name": "1041548",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041548"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-5/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-5/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-15605",
"datePublished": "2018-08-24T19:00:00",
"dateReserved": "2018-08-21T00:00:00",
"dateUpdated": "2024-08-05T10:01:54.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9850
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-61 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94529 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.526Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-61"
},
{
"name": "94529",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94529"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-61"
},
{
"name": "94529",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94529"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9850",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-61",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-61"
},
{
"name": "94529",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94529"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9850",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1803
Vulnerability from cvelistv5
Published
2006-04-18 10:00
Modified
2024-08-07 17:27
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/1372 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/19659 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/430902/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25796 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/431013/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/19897 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.novell.com/linux/security/advisories/2006_04_28.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/17487 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:27:29.455Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-1372",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/430902/100/0/threaded"
},
{
"name": "phpmyadmin-sql-xss(25796)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25796"
},
{
"name": "20060414 Re: phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"name": "17487",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17487"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-04-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-1372",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/430902/100/0/threaded"
},
{
"name": "phpmyadmin-sql-xss(25796)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25796"
},
{
"name": "20060414 Re: phpMyAdmin 2.7.0-pl1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"name": "17487",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17487"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1803",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-1372",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"name": "19659",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19659"
},
{
"name": "20060412 phpMyAdmin 2.7.0-pl1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/430902/100/0/threaded"
},
{
"name": "phpmyadmin-sql-xss(25796)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25796"
},
{
"name": "20060414 Re: phpMyAdmin 2.7.0-pl1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"name": "19897",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"name": "17487",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17487"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1803",
"datePublished": "2006-04-18T10:00:00",
"dateReserved": "2006-04-17T00:00:00",
"dateUpdated": "2024-08-07T17:27:29.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2001-0478
Vulnerability from cvelistv5
Published
2001-05-24 04:00
Modified
2024-08-08 04:21
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/2642 | vdb-entry, x_refsource_BID | |
| http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T04:21:38.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "2642",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/2642"
},
{
"name": "20010423 (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2001-04-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2002-01-18T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "2642",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/2642"
},
{
"name": "20010423 (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2001-0478",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "2642",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/2642"
},
{
"name": "20010423 (SRPRE00001) phpMyAdmin 2.1.0 and phpPgAdmin 2.2.1",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2001-0478",
"datePublished": "2001-05-24T04:00:00",
"dateReserved": "2001-05-24T00:00:00",
"dateUpdated": "2024-08-08T04:21:38.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5730
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-23/ | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/91379 | vdb-entry, x_refsource_BID | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.488Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-23/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "91379",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91379"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-23/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "91379",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91379"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5730",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b"
},
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-23/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-23/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "91379",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91379"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5730",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-21T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-26934
Vulnerability from cvelistv5
Published
2020-10-10 18:27
Modified
2024-08-04 16:03
Severity ?
EPSS score ?
Summary
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2020-5/ | x_refsource_MISC | |
| http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html | vendor-advisory, x_refsource_SUSE | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html | mailing-list, x_refsource_MLIST | |
| http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html | vendor-advisory, x_refsource_SUSE | |
| https://security.gentoo.org/glsa/202101-35 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:03:23.167Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-5/"
},
{
"name": "openSUSE-SU-2020:1675",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202101-35"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-27T17:06:13",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-5/"
},
{
"name": "openSUSE-SU-2020:1675",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/202101-35"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-26934",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-5/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-5/"
},
{
"name": "openSUSE-SU-2020:1675",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"name": "FEDORA-2020-4e78c86902",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"name": "FEDORA-2020-eadda524a8",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"name": "FEDORA-2020-43d8624421",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"name": "[debian-lts-announce] 20201025 [SECURITY] [DLA 2413-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"name": "openSUSE-SU-2020:1806",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"name": "GLSA-202101-35",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/202101-35"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-26934",
"datePublished": "2020-10-10T18:27:11",
"dateReserved": "2020-10-10T00:00:00",
"dateUpdated": "2024-08-04T16:03:23.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5000
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-09-16 19:05
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.123Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-30T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5000",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5000",
"datePublished": "2013-07-30T18:00:00Z",
"dateReserved": "2013-07-29T00:00:00Z",
"dateUpdated": "2024-09-16T19:05:30.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6373
Vulnerability from cvelistv5
Published
2006-12-07 17:00
Modified
2024-08-07 20:26
Severity ?
EPSS score ?
Summary
PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/30737 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/453432/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/1993 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:26:46.107Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-commonlib-path-disclosure(30737)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30737"
},
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "1993",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1993"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-commonlib-path-disclosure(30737)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30737"
},
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "1993",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1993"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6373",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-commonlib-path-disclosure(30737)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30737"
},
{
"name": "20061203 PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"name": "1993",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1993"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6373",
"datePublished": "2006-12-07T17:00:00",
"dateReserved": "2006-12-07T00:00:00",
"dateUpdated": "2024-08-07T20:26:46.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6614
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-37 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/94366 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.942Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-37"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "94366",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94366"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-37"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "94366",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94366"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6614",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-37",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-37"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "94366",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94366"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6614",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2631
Vulnerability from cvelistv5
Published
2005-12-04 22:00
Modified
2024-08-08 01:36
Severity ?
EPSS score ?
Summary
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.osvdb.org/7314 | vdb-entry, x_refsource_OSVDB | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/11974 | third-party-advisory, x_refsource_SECUNIA | |
| http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16542 | vdb-entry, x_refsource_XF | |
| http://www.securiteam.com/unixfocus/5QP040ADFW.html | x_refsource_MISC | |
| http://marc.info/?l=bugtraq&m=109816584519779&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/10629 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1010614 | vdb-entry, x_refsource_SECTRACK | |
| http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml | vendor-advisory, x_refsource_GENTOO | |
| http://eagle.kecapi.com/sec/fd/phpMyAdmin.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:36:24.870Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"name": "7314",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/7314"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "phpmyadmin-php-injection(16542)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16542"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securiteam.com/unixfocus/5QP040ADFW.html"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"name": "10629",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010614"
},
{
"name": "GLSA-200407-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-10-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"name": "7314",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/7314"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "phpmyadmin-php-injection(16542)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16542"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securiteam.com/unixfocus/5QP040ADFW.html"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"name": "10629",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010614"
},
{
"name": "GLSA-200407-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2631",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"name": "7314",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/7314"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "phpmyadmin-php-injection(16542)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16542"
},
{
"name": "http://www.securiteam.com/unixfocus/5QP040ADFW.html",
"refsource": "MISC",
"url": "http://www.securiteam.com/unixfocus/5QP040ADFW.html"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"name": "10629",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010614"
},
{
"name": "GLSA-200407-22",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"name": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html",
"refsource": "MISC",
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2631",
"datePublished": "2005-12-04T22:00:00",
"dateReserved": "2005-12-04T00:00:00",
"dateUpdated": "2024-08-08T01:36:24.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6624
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92489 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-47 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.397Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92489",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92489"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-47"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92489",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92489"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-47"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6624",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92489",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92489"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-47",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-47"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6624",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.397Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2041
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49 | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:49.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2041",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2041",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:49.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0992
Vulnerability from cvelistv5
Published
2005-04-07 04:00
Modified
2024-08-07 21:35
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=111264361622660&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/12982 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/14799 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.arrelnet.com/advisories/adv20050403.html | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/19940 | vdb-entry, x_refsource_XF | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3 | x_refsource_CONFIRM | |
| http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:35:59.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050404 phpMyAdmin Cross-site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111264361622660\u0026w=2"
},
{
"name": "12982",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/12982"
},
{
"name": "14799",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14799"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.arrelnet.com/advisories/adv20050403.html"
},
{
"name": "phpmyadmin-convcharset-xss(19940)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19940"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3"
},
{
"name": "GLSA-200504-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-04-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050404 phpMyAdmin Cross-site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111264361622660\u0026w=2"
},
{
"name": "12982",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/12982"
},
{
"name": "14799",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14799"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.arrelnet.com/advisories/adv20050403.html"
},
{
"name": "phpmyadmin-convcharset-xss(19940)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19940"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3"
},
{
"name": "GLSA-200504-08",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0992",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050404 phpMyAdmin Cross-site Scripting Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111264361622660\u0026w=2"
},
{
"name": "12982",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/12982"
},
{
"name": "14799",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14799"
},
{
"name": "http://www.arrelnet.com/advisories/adv20050403.html",
"refsource": "MISC",
"url": "http://www.arrelnet.com/advisories/adv20050403.html"
},
{
"name": "phpmyadmin-convcharset-xss(19940)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19940"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3"
},
{
"name": "GLSA-200504-08",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0992",
"datePublished": "2005-04-07T04:00:00",
"dateReserved": "2005-04-07T00:00:00",
"dateUpdated": "2024-08-07T21:35:59.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5976
Vulnerability from cvelistv5
Published
2007-11-15 00:00
Modified
2024-08-07 15:47
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/27630 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/26512 | vdb-entry, x_refsource_BID | |
| http://www.vupen.com/english/advisories/2007/3824 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/27753 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/38403 | vdb-entry, x_refsource_XF | |
| http://sourceforge.net/project/shownotes.php?release_id=553333 | x_refsource_CONFIRM | |
| http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html | x_refsource_MISC | |
| https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:229 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:47:00.631Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "27630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27630"
},
{
"name": "26512",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "ADV-2007-3824",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27753"
},
{
"name": "phpmyadmin-dbcreate-sql-injection(38403)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38403"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-11-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "27630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27630"
},
{
"name": "26512",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "ADV-2007-3824",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27753"
},
{
"name": "phpmyadmin-dbcreate-sql-injection(38403)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38403"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5976",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "27630",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27630"
},
{
"name": "26512",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "ADV-2007-3824",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27753"
},
{
"name": "phpmyadmin-dbcreate-sql-injection(38403)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38403"
},
{
"name": "http://sourceforge.net/project/shownotes.php?release_id=553333",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"name": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html",
"refsource": "MISC",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5976",
"datePublished": "2007-11-15T00:00:00",
"dateReserved": "2007-11-14T00:00:00",
"dateUpdated": "2024-08-07T15:47:00.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6942
Vulnerability from cvelistv5
Published
2007-01-19 02:00
Modified
2024-08-07 20:42
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2006/4572 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/26733 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=116370414309444&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/30310 | vdb-entry, x_refsource_XF | |
| http://www.us.debian.org/security/2007/dsa-1370 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.securityfocus.com/bid/21137 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:42:07.818Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7"
},
{
"name": "ADV-2006-4572",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "phpmyadmin-multiple-parameter-xss(30310)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30310"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "21137",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21137"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7"
},
{
"name": "ADV-2006-4572",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "phpmyadmin-multiple-parameter-xss(30310)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30310"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "21137",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21137"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6942",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7"
},
{
"name": "ADV-2006-4572",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26733"
},
{
"name": "20061116 PhpMyAdmin all version [multiples vulnerability]",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"name": "phpmyadmin-multiple-parameter-xss(30310)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30310"
},
{
"name": "DSA-1370",
"refsource": "DEBIAN",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "21137",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21137"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6942",
"datePublished": "2007-01-19T02:00:00",
"dateReserved": "2007-01-18T00:00:00",
"dateUpdated": "2024-08-07T20:42:07.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3787
Vulnerability from cvelistv5
Published
2005-11-24 01:00
Modified
2024-08-07 23:24
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/423142/100/0/threaded | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/16389 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/17578 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/18618 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:24:36.218Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "16389",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16389"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7"
},
{
"name": "17578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17578"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18618"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "16389",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16389"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7"
},
{
"name": "17578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17578"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18618"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3787",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SA:2006:004",
"refsource": "SUSE",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "16389",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16389"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7"
},
{
"name": "17578",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17578"
},
{
"name": "18618",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18618"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3787",
"datePublished": "2005-11-24T01:00:00",
"dateReserved": "2005-11-24T00:00:00",
"dateUpdated": "2024-08-07T23:24:36.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-1285
Vulnerability from cvelistv5
Published
2009-04-16 15:00
Modified
2024-08-07 05:04
Severity ?
EPSS score ?
Summary
Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2009/1045 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/34741 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/34727 | third-party-advisory, x_refsource_SECUNIA | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248&r2=12301&pathrev=12342 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/34526 | vdb-entry, x_refsource_BID | |
| https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html | vendor-advisory, x_refsource_FEDORA | |
| https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:04:49.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php"
},
{
"name": "ADV-2009-1045",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/1045"
},
{
"name": "34741",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34741"
},
{
"name": "34727",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34727"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342"
},
{
"name": "34526",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/34526"
},
{
"name": "FEDORA-2009-3700",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html"
},
{
"name": "FEDORA-2009-3692",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-04-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-04-28T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php"
},
{
"name": "ADV-2009-1045",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/1045"
},
{
"name": "34741",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34741"
},
{
"name": "34727",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34727"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342"
},
{
"name": "34526",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/34526"
},
{
"name": "FEDORA-2009-3700",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html"
},
{
"name": "FEDORA-2009-3692",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1285",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php"
},
{
"name": "ADV-2009-1045",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/1045"
},
{
"name": "34741",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34741"
},
{
"name": "34727",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34727"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342"
},
{
"name": "34526",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34526"
},
{
"name": "FEDORA-2009-3700",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html"
},
{
"name": "FEDORA-2009-3692",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1285",
"datePublished": "2009-04-16T15:00:00",
"dateReserved": "2009-04-10T00:00:00",
"dateUpdated": "2024-08-07T05:04:49.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-1879
Vulnerability from cvelistv5
Published
2014-02-20 11:00
Modified
2024-08-06 09:58
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/65717 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/59832 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:58:15.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php"
},
{
"name": "65717",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65717"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59832"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a"
},
{
"name": "openSUSE-SU-2014:0344",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-14T16:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php"
},
{
"name": "65717",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65717"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59832"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a"
},
{
"name": "openSUSE-SU-2014:0344",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1879",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php"
},
{
"name": "65717",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65717"
},
{
"name": "59832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59832"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a"
},
{
"name": "openSUSE-SU-2014:0344",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1879",
"datePublished": "2014-02-20T11:00:00",
"dateReserved": "2014-02-07T00:00:00",
"dateUpdated": "2024-08-06T09:58:15.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6627
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92494 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-50 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.136Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92494",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92494"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-50"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92494",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92494"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-50"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6627",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92494",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92494"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-50",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-50"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6627",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2508
Vulnerability from cvelistv5
Published
2011-07-14 23:00
Modified
2024-08-06 23:00
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "73614",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/73614"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45139"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta-\u003ename][transformation] parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "73614",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/73614"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45139"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-2508",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta-\u003ename][transformation] parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt",
"refsource": "MISC",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php"
},
{
"name": "45292",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "73614",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/73614"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "45139",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45139"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=b434320eff8ca9c2fc1b043c1804f868341af9a7",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=b434320eff8ca9c2fc1b043c1804f868341af9a7"
},
{
"name": "DSA-2286",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html",
"refsource": "MISC",
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2508",
"datePublished": "2011-07-14T23:00:00",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3240
Vulnerability from cvelistv5
Published
2013-04-26 01:00
Modified
2024-08-06 16:00
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:00:10.089Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-04-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-19T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3240",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130424 [waraxe-2013-SA#103] - Multiple Vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3240",
"datePublished": "2013-04-26T01:00:00",
"dateReserved": "2013-04-22T00:00:00",
"dateUpdated": "2024-08-06T16:00:10.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6633
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92500 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-56 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92500",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92500"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-56"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92500",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92500"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-56"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6633",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92500",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92500"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-56",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-56"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6633",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5731
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-24/ | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.527Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5731",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-24/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5731",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-21T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-1149
Vulnerability from cvelistv5
Published
2008-03-04 23:00
Modified
2024-08-07 08:08
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:08:57.697Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2008-2189",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html"
},
{
"name": "ADV-2008-0731",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0731"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-0758",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/0758"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "29287",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29287"
},
{
"name": "FEDORA-2008-2229",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html"
},
{
"name": "28068",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28068"
},
{
"name": "phpmyadmin-request-sql-injection(40968)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40968"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1"
},
{
"name": "GLSA-200803-15",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml"
},
{
"name": "29200",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29200"
},
{
"name": "29143",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29143"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-03-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2008-2189",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html"
},
{
"name": "ADV-2008-0731",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0731"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-0758",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/0758"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "29287",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29287"
},
{
"name": "FEDORA-2008-2229",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html"
},
{
"name": "28068",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28068"
},
{
"name": "phpmyadmin-request-sql-injection(40968)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40968"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1"
},
{
"name": "GLSA-200803-15",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml"
},
{
"name": "29200",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29200"
},
{
"name": "29143",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29143"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1149",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2008-2189",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html"
},
{
"name": "ADV-2008-0731",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0731"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-0758",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0758"
},
{
"name": "DSA-1557",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30816"
},
{
"name": "29287",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29287"
},
{
"name": "FEDORA-2008-2229",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html"
},
{
"name": "28068",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28068"
},
{
"name": "phpmyadmin-request-sql-injection(40968)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40968"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1"
},
{
"name": "GLSA-200803-15",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml"
},
{
"name": "29200",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29200"
},
{
"name": "29143",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29143"
},
{
"name": "SUSE-SR:2008:026",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1149",
"datePublished": "2008-03-04T23:00:00",
"dateReserved": "2008-03-04T00:00:00",
"dateUpdated": "2024-08-07T08:08:57.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5002
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-08-06 16:59
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/59832 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/61516 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61516",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61516"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61516",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61516"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5002",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "59832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59832"
},
{
"name": "61516",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61516"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5002",
"datePublished": "2013-07-30T18:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:41.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4349
Vulnerability from cvelistv5
Published
2014-06-25 10:00
Modified
2024-08-06 11:12
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be | x_refsource_CONFIRM | |
| http://phpmyadmin.net/home_page/security/PMASA-2014-3.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/68205 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:12:35.275Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php"
},
{
"name": "68205",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68205"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-01T14:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php"
},
{
"name": "68205",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68205"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4349",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be"
},
{
"name": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php"
},
{
"name": "68205",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68205"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4349",
"datePublished": "2014-06-25T10:00:00",
"dateReserved": "2014-06-20T00:00:00",
"dateUpdated": "2024-08-06T11:12:35.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-25727
Vulnerability from cvelistv5
Published
2023-02-13 00:00
Modified
2024-08-02 11:32
Severity ?
EPSS score ?
Summary
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:32:12.543Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2023-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-13T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.phpmyadmin.net/security/PMASA-2023-1/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-25727",
"datePublished": "2023-02-13T00:00:00",
"dateReserved": "2023-02-13T00:00:00",
"dateUpdated": "2024-08-02T11:32:12.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-5117
Vulnerability from cvelistv5
Published
2006-10-02 20:00
Modified
2024-08-07 19:41
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/22126 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/20253 | vdb-entry, x_refsource_BID | |
| http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download | x_refsource_CONFIRM | |
| http://secunia.com/advisories/23086 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:41:04.831Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "22126",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-11-30T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "22126",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5117",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "22126",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/20253"
},
{
"name": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download",
"refsource": "CONFIRM",
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "23086",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5117",
"datePublished": "2006-10-02T20:00:00",
"dateReserved": "2006-10-02T00:00:00",
"dateUpdated": "2024-08-07T19:41:04.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-4096
Vulnerability from cvelistv5
Published
2008-09-17 18:06
Modified
2024-08-07 10:00
Severity ?
EPSS score ?
Summary
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:00:42.597Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "31884",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31884"
},
{
"name": "31918",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31918"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-8370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
},
{
"name": "ADV-2008-2585",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2585"
},
{
"name": "FEDORA-2008-8269",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
},
{
"name": "48196",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/48196"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
},
{
"name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "FEDORA-2008-8335",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
},
{
"name": "FEDORA-2008-8286",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
},
{
"name": "phpmyadmin-serverdatabases-code-execution(45157)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "31188",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31188"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
},
{
"name": "32034",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32034"
},
{
"name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
},
{
"name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
},
{
"name": "ADV-2008-2619",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2619"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-09-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "31884",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31884"
},
{
"name": "31918",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31918"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-8370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
},
{
"name": "ADV-2008-2585",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2585"
},
{
"name": "FEDORA-2008-8269",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
},
{
"name": "48196",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/48196"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
},
{
"name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "FEDORA-2008-8335",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
},
{
"name": "FEDORA-2008-8286",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
},
{
"name": "phpmyadmin-serverdatabases-code-execution(45157)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "31188",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31188"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
},
{
"name": "32034",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32034"
},
{
"name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
},
{
"name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
},
{
"name": "ADV-2008-2619",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2619"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4096",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2008:202",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "31884",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31884"
},
{
"name": "31918",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31918"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "FEDORA-2008-8370",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
},
{
"name": "ADV-2008-2585",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2585"
},
{
"name": "FEDORA-2008-8269",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
},
{
"name": "48196",
"refsource": "OSVDB",
"url": "http://osvdb.org/48196"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=462430",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
},
{
"name": "[oss-security] 20080915 phpMyAdmin code execution (CVE request)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
},
{
"name": "GLSA-200903-32",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "FEDORA-2008-8335",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
},
{
"name": "FEDORA-2008-8286",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
},
{
"name": "phpmyadmin-serverdatabases-code-execution(45157)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
},
{
"name": "DSA-1641",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "31188",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31188"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
},
{
"name": "32034",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32034"
},
{
"name": "[phpmyadmin-news] 20080915 phpMyAdmin 2.11.9.1 is released",
"refsource": "MLIST",
"url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
},
{
"name": "http://fd.the-wildcat.de/pma_e36a091q11.php",
"refsource": "MISC",
"url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
},
{
"name": "[oss-security] 20080915 Re: phpMyAdmin code execution (CVE request)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
},
{
"name": "ADV-2008-2619",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2619"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4096",
"datePublished": "2008-09-17T18:06:00",
"dateReserved": "2008-09-15T00:00:00",
"dateUpdated": "2024-08-07T10:00:42.597Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2632
Vulnerability from cvelistv5
Published
2005-12-04 22:00
Modified
2024-08-08 01:36
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/11974 | third-party-advisory, x_refsource_SECUNIA | |
| http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.osvdb.org/7315 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/10629 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/alerts/2004/Jun/1010614.html | vdb-entry, x_refsource_SECTRACK | |
| http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml | vendor-advisory, x_refsource_GENTOO | |
| http://eagle.kecapi.com/sec/fd/phpMyAdmin.html | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16555 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:36:24.496Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "7315",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/7315"
},
{
"name": "10629",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/alerts/2004/Jun/1010614.html"
},
{
"name": "GLSA-200407-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"name": "phpmyadmin-code-manipulation(16555)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16555"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-10-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg[\u0027Servers\u0027] variables."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "7315",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/7315"
},
{
"name": "10629",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/alerts/2004/Jun/1010614.html"
},
{
"name": "GLSA-200407-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"name": "phpmyadmin-code-manipulation(16555)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16555"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2632",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg[\u0027Servers\u0027] variables."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20040630 Re: php codes injection in phpMyAdmin version 2.5.7.",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"name": "11974",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11974"
},
{
"name": "20040628 php codes injection in phpMyAdmin version 2.5.7.",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"name": "7315",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/7315"
},
{
"name": "10629",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10629"
},
{
"name": "1010614",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/alerts/2004/Jun/1010614.html"
},
{
"name": "GLSA-200407-22",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"name": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html",
"refsource": "MISC",
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"name": "phpmyadmin-code-manipulation(16555)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16555"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2632",
"datePublished": "2005-12-04T22:00:00",
"dateReserved": "2005-12-04T00:00:00",
"dateUpdated": "2024-08-08T01:36:24.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10803
Vulnerability from cvelistv5
Published
2020-03-22 03:48
Modified
2024-08-04 11:14
Severity ?
EPSS score ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2020-4/ | x_refsource_MISC | |
| https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html | mailing-list, x_refsource_MLIST | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html | vendor-advisory, x_refsource_SUSE | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:14:15.610Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-01T18:06:16",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10803",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-4/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10803",
"datePublished": "2020-03-22T03:48:16",
"dateReserved": "2020-03-22T00:00:00",
"dateUpdated": "2024-08-04T11:14:15.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-4480
Vulnerability from cvelistv5
Published
2010-12-08 15:00
Modified
2024-08-07 03:51
Severity ?
EPSS score ?
Summary
error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2011/0027 | vdb-entry, x_refsource_VUPEN | |
| http://www.vupen.com/english/advisories/2011/0001 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/45633 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/42485 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.debian.org/security/2010/dsa-2139 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.exploit-db.com/exploits/15699 | exploit, x_refsource_EXPLOIT-DB | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/3133 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/42725 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:16.863Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2011-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45633",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45633"
},
{
"name": "42485",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "15699",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/15699"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php"
},
{
"name": "ADV-2010-3133",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/3133"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-12-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing \"@\" characters, as demonstrated using \"[a@url@page]\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-18T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2011-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45633",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45633"
},
{
"name": "42485",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "15699",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/15699"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php"
},
{
"name": "ADV-2010-3133",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/3133"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4480",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing \"@\" characters, as demonstrated using \"[a@url@page]\"."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2011-0027",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"name": "ADV-2011-0001",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45633",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45633"
},
{
"name": "42485",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42485"
},
{
"name": "DSA-2139",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "15699",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/15699"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php"
},
{
"name": "ADV-2010-3133",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/3133"
},
{
"name": "42725",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42725"
},
{
"name": "MDVSA-2011:000",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4480",
"datePublished": "2010-12-08T15:00:00",
"dateReserved": "2010-12-07T00:00:00",
"dateUpdated": "2024-08-07T03:51:16.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4997
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-09-16 19:52
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-30T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4997",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4997",
"datePublished": "2013-07-30T18:00:00Z",
"dateReserved": "2013-07-29T00:00:00Z",
"dateUpdated": "2024-09-16T19:52:13.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5099
Vulnerability from cvelistv5
Published
2016-07-05 01:00
Modified
2024-08-06 00:53
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html | vendor-advisory, x_refsource_SUSE | |
| https://www.phpmyadmin.net/security/PMASA-2016-16 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1035979 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/90877 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:53:47.122Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-16"
},
{
"name": "1035979",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1035979"
},
{
"name": "90877",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/90877"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-05-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-01T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:1556",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-16"
},
{
"name": "1035979",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1035979"
},
{
"name": "90877",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/90877"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5099",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:1556",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-16",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-16"
},
{
"name": "1035979",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1035979"
},
{
"name": "90877",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/90877"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5099",
"datePublished": "2016-07-05T01:00:00",
"dateReserved": "2016-05-26T00:00:00",
"dateUpdated": "2024-08-06T00:53:47.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6632
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92497 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-55 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92497",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92497"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-55"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92497",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92497"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-55"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6632",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92497",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92497"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-55",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-55"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6632",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5977
Vulnerability from cvelistv5
Published
2007-11-15 00:00
Modified
2024-08-07 15:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/27630 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/26512 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/38404 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2007/3824 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/27753 | third-party-advisory, x_refsource_SECUNIA | |
| http://sourceforge.net/project/shownotes.php?release_id=553333 | x_refsource_CONFIRM | |
| http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html | x_refsource_MISC | |
| https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:229 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:47:00.692Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "27630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27630"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7"
},
{
"name": "26512",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "phpmyadmin-dbcreate-xss(38404)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38404"
},
{
"name": "ADV-2007-3824",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27753"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-11-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "27630",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27630"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7"
},
{
"name": "26512",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "phpmyadmin-dbcreate-xss(38404)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38404"
},
{
"name": "ADV-2007-3824",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27753"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5977",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "27630",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27630"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7"
},
{
"name": "26512",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"name": "phpmyadmin-dbcreate-xss(38404)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38404"
},
{
"name": "ADV-2007-3824",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"name": "27753",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27753"
},
{
"name": "http://sourceforge.net/project/shownotes.php?release_id=553333",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"name": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html",
"refsource": "MISC",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"name": "FEDORA-2007-3666",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"name": "MDKSA-2007:229",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5977",
"datePublished": "2007-11-15T00:00:00",
"dateReserved": "2007-11-14T00:00:00",
"dateUpdated": "2024-08-07T15:47:00.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-8958
Vulnerability from cvelistv5
Published
2014-11-30 11:00
Modified
2024-08-06 13:33
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/71243 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0 | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:228 | vendor-advisory, x_refsource_MANDRIVA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:12.660Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php"
},
{
"name": "71243",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-20T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php"
},
{
"name": "71243",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8958",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "openSUSE-SU-2014:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php"
},
{
"name": "71243",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71243"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0"
},
{
"name": "MDVSA-2014:228",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8958",
"datePublished": "2014-11-30T11:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T13:33:12.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-4326
Vulnerability from cvelistv5
Published
2008-09-30 16:00
Modified
2024-08-07 10:08
Severity ?
EPSS score ?
Summary
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:08:35.116Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/"
},
{
"name": "DSA-1675",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1675"
},
{
"name": "ADV-2008-2657",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2657"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1"
},
{
"name": "48511",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/48511"
},
{
"name": "[oss-security] 20080923 CVE req: phpmyadmin \u003c 2.11.9.2 xss",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/22/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "JVNDB-2008-000061",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html"
},
{
"name": "32954",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32954"
},
{
"name": "31974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31974"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603"
},
{
"name": "JVN#54824688",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN54824688/index.html"
},
{
"name": "31992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31992"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-09-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a \"\u003c/script\" sequence."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-10-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/"
},
{
"name": "DSA-1675",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1675"
},
{
"name": "ADV-2008-2657",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2657"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1"
},
{
"name": "48511",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/48511"
},
{
"name": "[oss-security] 20080923 CVE req: phpmyadmin \u003c 2.11.9.2 xss",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/22/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "JVNDB-2008-000061",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html"
},
{
"name": "32954",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32954"
},
{
"name": "31974",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31974"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603"
},
{
"name": "JVN#54824688",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN54824688/index.html"
},
{
"name": "31992",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31992"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4326",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a \"\u003c/script\" sequence."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/"
},
{
"name": "DSA-1675",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1675"
},
{
"name": "ADV-2008-2657",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2657"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1"
},
{
"name": "48511",
"refsource": "OSVDB",
"url": "http://osvdb.org/48511"
},
{
"name": "[oss-security] 20080923 CVE req: phpmyadmin \u003c 2.11.9.2 xss",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/09/22/2"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "JVNDB-2008-000061",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html"
},
{
"name": "32954",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32954"
},
{
"name": "31974",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31974"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603"
},
{
"name": "JVN#54824688",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN54824688/index.html"
},
{
"name": "31992",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31992"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4326",
"datePublished": "2008-09-30T16:00:00",
"dateReserved": "2008-09-30T00:00:00",
"dateUpdated": "2024-08-07T10:08:35.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-7873
Vulnerability from cvelistv5
Published
2015-10-28 10:00
Modified
2024-08-06 08:06
Severity ?
EPSS score ?
Summary
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2015-5/ | x_refsource_CONFIRM | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securitytracker.com/id/1034013 | vdb-entry, x_refsource_SECTRACK | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securityfocus.com/bid/77299 | vdb-entry, x_refsource_BID | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:06:30.262Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-5/"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-5c06260c4b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html"
},
{
"name": "1034013",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1034013"
},
{
"name": "FEDORA-2015-287c164df5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html"
},
{
"name": "77299",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/77299"
},
{
"name": "FEDORA-2015-17908c56c1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-10-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-05T22:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-5/"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-5c06260c4b",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html"
},
{
"name": "1034013",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1034013"
},
{
"name": "FEDORA-2015-287c164df5",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html"
},
{
"name": "77299",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/77299"
},
{
"name": "FEDORA-2015-17908c56c1",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7873",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2015-5/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2015-5/"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-5c06260c4b",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html"
},
{
"name": "1034013",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1034013"
},
{
"name": "FEDORA-2015-287c164df5",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html"
},
{
"name": "77299",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/77299"
},
{
"name": "FEDORA-2015-17908c56c1",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7873",
"datePublished": "2015-10-28T10:00:00",
"dateReserved": "2015-10-20T00:00:00",
"dateUpdated": "2024-08-06T08:06:30.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0653
Vulnerability from cvelistv5
Published
2005-03-07 05:00
Modified
2024-08-07 21:21
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml | vendor-advisory, x_refsource_GENTOO | |
| http://bugs.gentoo.org/show_bug.cgi?id=83792 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:21:06.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=83792"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-03-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T16:38:57",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=83792"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0653",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-200503-07",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=83792",
"refsource": "MISC",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=83792"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0653",
"datePublished": "2005-03-07T05:00:00",
"dateReserved": "2005-03-07T00:00:00",
"dateUpdated": "2024-08-07T21:21:06.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2045
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:49.970Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-21T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2045",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2045",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:49.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6628
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92492 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-51 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.448Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92492",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92492"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-51"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92492",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92492"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-51"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6628",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92492",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92492"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-51",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-51"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6628",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-1148
Vulnerability from cvelistv5
Published
2009-03-26 14:00
Modified
2024-08-07 05:04
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable).
References
| ▼ | URL | Tags |
|---|---|---|
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303 | x_refsource_MISC | |
| http://secunia.com/advisories/34642 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/34468 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:04:48.474Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34468"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-04-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34468"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1148",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303",
"refsource": "MISC",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"name": "34642",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34642"
},
{
"name": "SUSE-SR:2009:008",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "34468",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34468"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1148",
"datePublished": "2009-03-26T14:00:00",
"dateReserved": "2009-03-26T00:00:00",
"dateUpdated": "2024-08-07T05:04:48.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9860
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94525 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://www.phpmyadmin.net/security/PMASA-2016-65 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.588Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9860",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94525",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-65",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9860",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5706
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| https://www.phpmyadmin.net/security/PMASA-2016-22/ | x_refsource_CONFIRM | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.securityfocus.com/bid/91376 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.526Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-22/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91376",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91376"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-22/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91376",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91376"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5706",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6"
},
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-22/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-22/"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91376",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91376"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5706",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2559
Vulnerability from cvelistv5
Published
2016-03-01 11:00
Modified
2024-08-05 23:32
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-10/ | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:32:20.791Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-10/"
},
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-10/"
},
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2559",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-10/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-10/"
},
{
"name": "FEDORA-2016-65da02b95c",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"
},
{
"name": "FEDORA-2016-02ee5b4002",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2559",
"datePublished": "2016-03-01T11:00:00",
"dateReserved": "2016-02-25T00:00:00",
"dateUpdated": "2024-08-05T23:32:20.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-2958
Vulnerability from cvelistv5
Published
2010-09-08 19:00
Modified
2024-08-07 02:55
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/41206 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.openwall.com/lists/oss-security/2010/09/01/2 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2010/09/01/3 | mailing-list, x_refsource_MLIST | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/2242 | vdb-entry, x_refsource_VUPEN | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:46.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41206",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41206"
},
{
"name": "[oss-security] 20100901 CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/2"
},
{
"name": "[oss-security] 20100901 Re: CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php"
},
{
"name": "ADV-2010-2242",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2242"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-09-14T09:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "41206",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41206"
},
{
"name": "[oss-security] 20100901 CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/2"
},
{
"name": "[oss-security] 20100901 Re: CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php"
},
{
"name": "ADV-2010-2242",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2242"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-2958",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "41206",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41206"
},
{
"name": "[oss-security] 20100901 CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/2"
},
{
"name": "[oss-security] 20100901 Re: CVE Request -- phpMyAdmin - v3.6.6 -- XSS attack using debugging messages (CVE-2010-3056 discussion)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/3"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php"
},
{
"name": "ADV-2010-2242",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2242"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=133a77fac7d31a38703db2099a90c1b49de62e37",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=133a77fac7d31a38703db2099a90c1b49de62e37"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2958",
"datePublished": "2010-09-08T19:00:00",
"dateReserved": "2010-08-04T00:00:00",
"dateUpdated": "2024-08-07T02:55:46.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-6830
Vulnerability from cvelistv5
Published
2015-09-14 01:00
Modified
2024-08-06 07:36
Severity ?
EPSS score ?
Summary
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/76674 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| https://www.phpmyadmin.net/security/PMASA-2015-4/ | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html | vendor-advisory, x_refsource_FEDORA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securitytracker.com/id/1033546 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:36:33.274Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "76674",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/76674"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-4/"
},
{
"name": "FEDORA-2015-15385",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html"
},
{
"name": "FEDORA-2015-15384",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e"
},
{
"name": "FEDORA-2015-15386",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html"
},
{
"name": "1033546",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1033546"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-09-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-20T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "76674",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/76674"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-4/"
},
{
"name": "FEDORA-2015-15385",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html"
},
{
"name": "FEDORA-2015-15384",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e"
},
{
"name": "FEDORA-2015-15386",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html"
},
{
"name": "1033546",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1033546"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-6830",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "76674",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/76674"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2015-4/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2015-4/"
},
{
"name": "FEDORA-2015-15385",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html"
},
{
"name": "FEDORA-2015-15384",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e"
},
{
"name": "FEDORA-2015-15386",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html"
},
{
"name": "1033546",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1033546"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-6830",
"datePublished": "2015-09-14T01:00:00",
"dateReserved": "2015-09-08T00:00:00",
"dateUpdated": "2024-08-06T07:36:33.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4999
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-09-17 04:29
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-30T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4999",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4999",
"datePublished": "2013-07-30T18:00:00Z",
"dateReserved": "2013-07-29T00:00:00Z",
"dateUpdated": "2024-09-17T04:29:15.997Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6610
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-33 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94118 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-33"
},
{
"name": "94118",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94118"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-33"
},
{
"name": "94118",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94118"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6610",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-33",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-33"
},
{
"name": "94118",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94118"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6610",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9857
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94530 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-64 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.527Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94530",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94530",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9857",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94530",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94530"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-64",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9857",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9858
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94525 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://www.phpmyadmin.net/security/PMASA-2016-65 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.570Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9858",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94525",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-65",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9858",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19968
Vulnerability from cvelistv5
Published
2018-12-11 17:00
Modified
2024-08-05 11:51
Severity ?
EPSS score ?
Summary
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/106178 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2018-6/ | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | mailing-list, x_refsource_MLIST | |
| https://security.gentoo.org/glsa/201904-16 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:51:17.786Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "106178",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106178"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-12-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-15T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "106178",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106178"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19968",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106178",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106178"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-6/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "GLSA-201904-16",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201904-16"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19968",
"datePublished": "2018-12-11T17:00:00",
"dateReserved": "2018-12-07T00:00:00",
"dateUpdated": "2024-08-05T11:51:17.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2630
Vulnerability from cvelistv5
Published
2005-12-04 22:00
Modified
2024-08-08 01:36
Severity ?
EPSS score ?
Summary
The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.osvdb.org/10715 | vdb-entry, x_refsource_OSVDB | |
| http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/11391 | vdb-entry, x_refsource_BID | |
| http://marc.info/?l=bugtraq&m=109816584519779&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/17698 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=full-disclosure&m=109810251501643&w=2 | mailing-list, x_refsource_FULLDISC | |
| http://secunia.com/advisories/12859 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/alerts/2004/Oct/1011761.html | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/12813 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:36:24.449Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "10715",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/10715"
},
{
"name": "GLSA-200410-14",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml"
},
{
"name": "11391",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/11391"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2"
},
{
"name": "phpmyadmin-command-execution(17698)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17698"
},
{
"name": "20041018: phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=109810251501643\u0026w=2"
},
{
"name": "12859",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/12859"
},
{
"name": "1011761",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/alerts/2004/Oct/1011761.html"
},
{
"name": "12813",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/12813"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-10-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "10715",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/10715"
},
{
"name": "GLSA-200410-14",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml"
},
{
"name": "11391",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/11391"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2"
},
{
"name": "phpmyadmin-command-execution(17698)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17698"
},
{
"name": "20041018: phpMyAdmin: Vulnerability in MIME-based transformation",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://marc.info/?l=full-disclosure\u0026m=109810251501643\u0026w=2"
},
{
"name": "12859",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/12859"
},
{
"name": "1011761",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/alerts/2004/Oct/1011761.html"
},
{
"name": "12813",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/12813"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2630",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "10715",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/10715"
},
{
"name": "GLSA-200410-14",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml"
},
{
"name": "11391",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/11391"
},
{
"name": "20041018 phpMyAdmin: Vulnerability in MIME-based transformation",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2"
},
{
"name": "phpmyadmin-command-execution(17698)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17698"
},
{
"name": "20041018: phpMyAdmin: Vulnerability in MIME-based transformation",
"refsource": "FULLDISC",
"url": "http://marc.info/?l=full-disclosure\u0026m=109810251501643\u0026w=2"
},
{
"name": "12859",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/12859"
},
{
"name": "1011761",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/alerts/2004/Oct/1011761.html"
},
{
"name": "12813",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/12813"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2630",
"datePublished": "2005-12-04T22:00:00",
"dateReserved": "2005-12-04T00:00:00",
"dateUpdated": "2024-08-08T01:36:24.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0129
Vulnerability from cvelistv5
Published
2004-09-01 04:00
Modified
2024-08-08 00:10
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/relnotes.php?rel=0 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15021 | vdb-entry, x_refsource_XF | |
| http://security.gentoo.org/glsa/glsa-200402-05.xml | vendor-advisory, x_refsource_GENTOO | |
| http://secunia.com/advisories/10769 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/3800 | vdb-entry, x_refsource_OSVDB | |
| http://marc.info/?l=bugtraq&m=107582619125932&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/9564 | vdb-entry, x_refsource_BID | |
| http://sourceforge.net/forum/forum.php?forum_id=350228 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:10:03.271Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0"
},
{
"name": "phpmyadmin-dotdot-directory-traversal(15021)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15021"
},
{
"name": "GLSA-200402-05",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200402-05.xml"
},
{
"name": "10769",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10769"
},
{
"name": "3800",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3800"
},
{
"name": "20040203 Arbitrary File Disclosure Vulnerability in phpMyAdmin 2.5.5-pl1 and prior",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107582619125932\u0026w=2"
},
{
"name": "9564",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9564"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=350228"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-02-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2004-08-18T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0"
},
{
"name": "phpmyadmin-dotdot-directory-traversal(15021)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15021"
},
{
"name": "GLSA-200402-05",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200402-05.xml"
},
{
"name": "10769",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10769"
},
{
"name": "3800",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3800"
},
{
"name": "20040203 Arbitrary File Disclosure Vulnerability in phpMyAdmin 2.5.5-pl1 and prior",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107582619125932\u0026w=2"
},
{
"name": "9564",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9564"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/forum/forum.php?forum_id=350228"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0129",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0"
},
{
"name": "phpmyadmin-dotdot-directory-traversal(15021)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15021"
},
{
"name": "GLSA-200402-05",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200402-05.xml"
},
{
"name": "10769",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10769"
},
{
"name": "3800",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3800"
},
{
"name": "20040203 Arbitrary File Disclosure Vulnerability in phpMyAdmin 2.5.5-pl1 and prior",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=107582619125932\u0026w=2"
},
{
"name": "9564",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9564"
},
{
"name": "http://sourceforge.net/forum/forum.php?forum_id=350228",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/forum/forum.php?forum_id=350228"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0129",
"datePublished": "2004-09-01T04:00:00",
"dateReserved": "2004-02-04T00:00:00",
"dateUpdated": "2024-08-08T00:10:03.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-2206
Vulnerability from cvelistv5
Published
2015-03-09 17:00
Modified
2024-08-06 05:10
Severity ?
EPSS score ?
Summary
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.securitytracker.com/id/1031871 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/72949 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2015:186 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:10:15.545Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-3287",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html"
},
{
"name": "1031871",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1031871"
},
{
"name": "72949",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/72949"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb"
},
{
"name": "FEDORA-2015-3336",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html"
},
{
"name": "MDVSA-2015:186",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:186"
},
{
"name": "FEDORA-2015-3329",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-03-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-23T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2015:1191",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-3287",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html"
},
{
"name": "1031871",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1031871"
},
{
"name": "72949",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/72949"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb"
},
{
"name": "FEDORA-2015-3336",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html"
},
{
"name": "MDVSA-2015:186",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:186"
},
{
"name": "FEDORA-2015-3329",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-2206",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2015:1191",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "FEDORA-2015-3287",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html"
},
{
"name": "1031871",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1031871"
},
{
"name": "72949",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/72949"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb"
},
{
"name": "FEDORA-2015-3336",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html"
},
{
"name": "MDVSA-2015:186",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:186"
},
{
"name": "FEDORA-2015-3329",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-2206",
"datePublished": "2015-03-09T17:00:00",
"dateReserved": "2015-03-04T00:00:00",
"dateUpdated": "2024-08-06T05:10:15.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-6799
Vulnerability from cvelistv5
Published
2019-01-26 17:00
Modified
2024-08-04 20:31
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2019-1/ | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/106736 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:31:04.093Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
},
{
"name": "[debian-lts-announce] 20190227 [SECURITY] [DLA 1692-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html"
},
{
"name": "106736",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106736"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server\u0027s user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of \"options(MYSQLI_OPT_LOCAL_INFILE\" calls."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-28T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
},
{
"name": "[debian-lts-announce] 20190227 [SECURITY] [DLA 1692-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html"
},
{
"name": "106736",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106736"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-6799",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server\u0027s user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of \"options(MYSQLI_OPT_LOCAL_INFILE\" calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2019-1/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
},
{
"name": "[debian-lts-announce] 20190227 [SECURITY] [DLA 1692-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html"
},
{
"name": "106736",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106736"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-6799",
"datePublished": "2019-01-26T17:00:00",
"dateReserved": "2019-01-24T00:00:00",
"dateUpdated": "2024-08-04T20:31:04.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6944
Vulnerability from cvelistv5
Published
2007-01-19 02:00
Modified
2024-08-07 20:42
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2006/4572 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/26733 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9 | x_refsource_CONFIRM | |
| http://www.us.debian.org/security/2007/dsa-1370 | vendor-advisory, x_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:42:07.921Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2006-4572",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26733"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-09-14T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2006-4572",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26733"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6944",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2006-4572",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"name": "26733",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26733"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9"
},
{
"name": "DSA-1370",
"refsource": "DEBIAN",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6944",
"datePublished": "2007-01-19T02:00:00",
"dateReserved": "2007-01-18T00:00:00",
"dateUpdated": "2024-08-07T20:42:07.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10802
Vulnerability from cvelistv5
Published
2020-03-22 03:48
Modified
2024-08-04 11:14
Severity ?
EPSS score ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2020-3/ | x_refsource_MISC | |
| https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html | mailing-list, x_refsource_MLIST | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html | vendor-advisory, x_refsource_SUSE | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:14:15.611Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-01T18:06:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10802",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-3/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
},
{
"name": "[debian-lts-announce] 20200322 [SECURITY] [DLA 2154-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"name": "openSUSE-SU-2020:0405",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10802",
"datePublished": "2020-03-22T03:48:33",
"dateReserved": "2020-03-22T00:00:00",
"dateUpdated": "2024-08-04T11:14:15.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3622
Vulnerability from cvelistv5
Published
2005-11-16 11:00
Modified
2024-08-07 23:17
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=113208319104035&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/185 | third-party-advisory, x_refsource_SREASON | |
| http://www.osvdb.org/20914 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/20912 | vdb-entry, x_refsource_OSVDB | |
| http://securitytracker.com/id?1015213 | vdb-entry, x_refsource_SECTRACK | |
| http://www.fitsec.com/advisories/FS-05-02.txt | x_refsource_MISC | |
| http://www.osvdb.org/20911 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/20913 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:17:23.405Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20051115 [FS-05-02] Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113208319104035\u0026w=2"
},
{
"name": "185",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/185"
},
{
"name": "20914",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20914"
},
{
"name": "20912",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20912"
},
{
"name": "1015213",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015213"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.fitsec.com/advisories/FS-05-02.txt"
},
{
"name": "20911",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20911"
},
{
"name": "20913",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20913"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"shortName": "debian"
},
"references": [
{
"name": "20051115 [FS-05-02] Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113208319104035\u0026w=2"
},
{
"name": "185",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/185"
},
{
"name": "20914",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20914"
},
{
"name": "20912",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20912"
},
{
"name": "1015213",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015213"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.fitsec.com/advisories/FS-05-02.txt"
},
{
"name": "20911",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20911"
},
{
"name": "20913",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20913"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@debian.org",
"ID": "CVE-2005-3622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20051115 [FS-05-02] Multiple vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=113208319104035\u0026w=2"
},
{
"name": "185",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/185"
},
{
"name": "20914",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20914"
},
{
"name": "20912",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20912"
},
{
"name": "1015213",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015213"
},
{
"name": "http://www.fitsec.com/advisories/FS-05-02.txt",
"refsource": "MISC",
"url": "http://www.fitsec.com/advisories/FS-05-02.txt"
},
{
"name": "20911",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20911"
},
{
"name": "20913",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20913"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
"assignerShortName": "debian",
"cveId": "CVE-2005-3622",
"datePublished": "2005-11-16T11:00:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-07T23:17:23.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-9218
Vulnerability from cvelistv5
Published
2014-12-08 11:00
Modified
2024-08-06 13:40
Severity ?
EPSS score ?
Summary
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.debian.org/security/2015/dsa-3382 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.securityfocus.com/bid/71434 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1 | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:243 | vendor-advisory, x_refsource_MANDRIVA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/99140 | vdb-entry, x_refsource_XF | |
| https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8 | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:40:24.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "71434",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71434"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1"
},
{
"name": "MDVSA-2014:243",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819"
},
{
"name": "phpmyadmin-cve20149218-dos(99140)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99140"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-12-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-07T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-3382",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "71434",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71434"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1"
},
{
"name": "MDVSA-2014:243",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819"
},
{
"name": "phpmyadmin-cve20149218-dos(99140)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99140"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-9218",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3382",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"name": "71434",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71434"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1"
},
{
"name": "MDVSA-2014:243",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819"
},
{
"name": "phpmyadmin-cve20149218-dos(99140)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99140"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-9218",
"datePublished": "2014-12-08T11:00:00",
"dateReserved": "2014-12-02T00:00:00",
"dateUpdated": "2024-08-06T13:40:24.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-2284
Vulnerability from cvelistv5
Published
2009-07-01 12:26
Modified
2024-08-07 05:44
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php | x_refsource_CONFIRM | |
| https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html | vendor-advisory, x_refsource_FEDORA | |
| http://secunia.com/advisories/35715 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/35649 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2009:192 | vendor-advisory, x_refsource_MANDRIVA | |
| https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:44:55.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2009-7329",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php"
},
{
"name": "FEDORA-2009-7340",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html"
},
{
"name": "35715",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35715"
},
{
"name": "35649",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35649"
},
{
"name": "MDVSA-2009:192",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:192"
},
{
"name": "FEDORA-2009-7337",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-06-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-07-18T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2009-7329",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php"
},
{
"name": "FEDORA-2009-7340",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html"
},
{
"name": "35715",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35715"
},
{
"name": "35649",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35649"
},
{
"name": "MDVSA-2009:192",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:192"
},
{
"name": "FEDORA-2009-7337",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-2284",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2009-7329",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php"
},
{
"name": "FEDORA-2009-7340",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html"
},
{
"name": "35715",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35715"
},
{
"name": "35649",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35649"
},
{
"name": "MDVSA-2009:192",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:192"
},
{
"name": "FEDORA-2009-7337",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-2284",
"datePublished": "2009-07-01T12:26:00",
"dateReserved": "2009-07-01T00:00:00",
"dateUpdated": "2024-08-07T05:44:55.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5386
Vulnerability from cvelistv5
Published
2007-10-12 10:00
Modified
2024-08-07 15:31
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:31:58.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log"
},
{
"name": "27173",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27173"
},
{
"name": "FEDORA-2007-2738",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "27506",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27506"
},
{
"name": "phpmyadmin-setup-xss(37077)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37077"
},
{
"name": "DSA-1403",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "20071015 about phpMyAdmin setup.php XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/482339/100/0/threaded"
},
{
"name": "37678",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/37678"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/27595"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a"
},
{
"name": "26020",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/26020"
},
{
"name": "ADV-2007-3469",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3469"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log"
},
{
"name": "27173",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27173"
},
{
"name": "FEDORA-2007-2738",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "27506",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27506"
},
{
"name": "phpmyadmin-setup-xss(37077)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37077"
},
{
"name": "DSA-1403",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "20071015 about phpMyAdmin setup.php XSS vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/482339/100/0/threaded"
},
{
"name": "37678",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/37678"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/27595"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a"
},
{
"name": "26020",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/26020"
},
{
"name": "ADV-2007-3469",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3469"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5386",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log"
},
{
"name": "27173",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27173"
},
{
"name": "FEDORA-2007-2738",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"name": "27506",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27506"
},
{
"name": "phpmyadmin-setup-xss(37077)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37077"
},
{
"name": "DSA-1403",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"name": "20071015 about phpMyAdmin setup.php XSS vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/482339/100/0/threaded"
},
{
"name": "37678",
"refsource": "OSVDB",
"url": "http://osvdb.org/37678"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "27595",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/27595"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=333661",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"name": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a",
"refsource": "MISC",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a"
},
{
"name": "26020",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/26020"
},
{
"name": "ADV-2007-3469",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3469"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748"
},
{
"name": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5386",
"datePublished": "2007-10-12T10:00:00",
"dateReserved": "2007-10-11T00:00:00",
"dateUpdated": "2024-08-07T15:31:58.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3591
Vulnerability from cvelistv5
Published
2014-12-26 02:00
Modified
2024-08-06 23:37
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2011/09/30/8 | mailing-list, x_refsource_MLIST | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=738681 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:37:48.399Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170"
},
{
"name": "[oss-security] 20110930 Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-12-26T02:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170"
},
{
"name": "[oss-security] 20110930 Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-3591",
"datePublished": "2014-12-26T02:00:00",
"dateReserved": "2011-09-21T00:00:00",
"dateUpdated": "2024-08-06T23:37:48.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9847
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-58 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94524 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-58"
},
{
"name": "94524",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94524"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user\u0027s blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-58"
},
{
"name": "94524",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94524"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9847",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user\u0027s blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-58",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-58"
},
{
"name": "94524",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94524"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9847",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10188
Vulnerability from cvelistv5
Published
2018-04-19 14:00
Modified
2024-08-05 07:32
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/103936 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1040752 | vdb-entry, x_refsource_SECTRACK | |
| https://www.phpmyadmin.net/security/PMASA-2018-2/ | x_refsource_CONFIRM | |
| https://www.exploit-db.com/exploits/44496/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.774Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "103936",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103936"
},
{
"name": "1040752",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1040752"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-2/"
},
{
"name": "44496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44496/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-28T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "103936",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103936"
},
{
"name": "1040752",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1040752"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-2/"
},
{
"name": "44496",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44496/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10188",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "103936",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103936"
},
{
"name": "1040752",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1040752"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-2/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-2/"
},
{
"name": "44496",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44496/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10188",
"datePublished": "2018-04-19T14:00:00",
"dateReserved": "2018-04-17T00:00:00",
"dateUpdated": "2024-08-05T07:32:01.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-5274
Vulnerability from cvelistv5
Published
2014-08-22 01:00
Modified
2024-08-06 11:41
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f | x_refsource_CONFIRM | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:41:47.772Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-08-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-14T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-5274",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-5274",
"datePublished": "2014-08-22T01:00:00",
"dateReserved": "2014-08-16T00:00:00",
"dateUpdated": "2024-08-06T11:41:47.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-22278
Vulnerability from cvelistv5
Published
2020-11-04 16:52
Modified
2024-08-04 14:51
Severity ?
EPSS score ?
Summary
phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
References
| ▼ | URL | Tags |
|---|---|---|
| https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs | x_refsource_MISC | |
| https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:51:10.772Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because \"the CSV file is accurately generated based on the database contents."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-06T07:59:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-22278",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because \"the CSV file is accurately generated based on the database contents.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs",
"refsource": "MISC",
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
},
{
"name": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf",
"refsource": "MISC",
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-22278",
"datePublished": "2020-11-04T16:52:26",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:51:10.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2042
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:17
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-21T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2042",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f"
},
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2042",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-22T00:00:00",
"dateUpdated": "2024-08-05T23:17:50.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000017
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2017-6 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95732 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:05.856Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"name": "95732",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95732"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-27T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"name": "95732",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95732"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.268738",
"ID": "CVE-2017-1000017",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-6",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"name": "95732",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95732"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000017",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:05.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-2960
Vulnerability from cvelistv5
Published
2008-07-02 17:00
Modified
2024-08-07 09:21
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/43320 | vdb-entry, x_refsource_XF | |
| http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html | vendor-advisory, x_refsource_SUSE | |
| http://secunia.com/advisories/30813 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/30816 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.vupen.com/english/advisories/2008/1904/references | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/33822 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.openwall.com/lists/oss-security/2008/07/16/11 | mailing-list, x_refsource_MLIST | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2008:131 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:21:34.545Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-libraryfiles-xss(43320)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43320"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "30813",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30813"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "ADV-2008-1904",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/1904/references"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "[oss-security] 20080716 Re: CVE request: phpmyadmin \u003c 2.11.7.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2008/07/16/11"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-libraryfiles-xss(43320)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43320"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "30813",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30813"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30816"
},
{
"name": "ADV-2008-1904",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/1904/references"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "[oss-security] 20080716 Re: CVE request: phpmyadmin \u003c 2.11.7.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2008/07/16/11"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-2960",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-libraryfiles-xss(43320)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43320"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "30813",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30813"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4"
},
{
"name": "30816",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30816"
},
{
"name": "ADV-2008-1904",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/1904/references"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "[oss-security] 20080716 Re: CVE request: phpmyadmin \u003c 2.11.7.1",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2008/07/16/11"
},
{
"name": "MDVSA-2008:131",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-2960",
"datePublished": "2008-07-02T17:00:00",
"dateReserved": "2008-07-02T00:00:00",
"dateUpdated": "2024-08-07T09:21:34.545Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6611
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-34 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94117 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.315Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-34"
},
{
"name": "94117",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94117"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-34"
},
{
"name": "94117",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94117"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6611",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-34",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-34"
},
{
"name": "94117",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94117"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6611",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9861
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94535 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-66 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94535",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94535"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-66"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94535",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94535"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-66"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9861",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94535",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94535"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-66",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-66"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9861",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2869
Vulnerability from cvelistv5
Published
2005-09-08 04:00
Modified
2024-08-07 22:53
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.novell.com/linux/security/advisories/2005_28_sr.html | vendor-advisory, x_refsource_SUSE | |
| http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html | vendor-advisory, x_refsource_SUSE | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1265740&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/17607 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/17559 | third-party-advisory, x_refsource_SECUNIA | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1240880&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2005/dsa-880 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/17337 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/16605 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:53:29.375Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17559"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "16605",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16605"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-11-04T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17559"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "16605",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16605"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2005:028",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408"
},
{
"name": "17607",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17607"
},
{
"name": "17559",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17559"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408"
},
{
"name": "DSA-880",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17337"
},
{
"name": "16605",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16605"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2869",
"datePublished": "2005-09-08T04:00:00",
"dateReserved": "2005-09-08T00:00:00",
"dateUpdated": "2024-08-07T22:53:29.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4780
Vulnerability from cvelistv5
Published
2011-12-22 20:00
Modified
2024-08-07 00:16
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/51226 | vdb-entry, x_refsource_BID | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=bd3735ba584e7a49aee78813845245354b061f61 | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:198 | vendor-advisory, x_refsource_MANDRIVA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:16:34.716Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "51226",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/51226"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=bd3735ba584e7a49aee78813845245354b061f61"
},
{
"name": "FEDORA-2011-17370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-12-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-01-19T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "51226",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/51226"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=bd3735ba584e7a49aee78813845245354b061f61"
},
{
"name": "FEDORA-2011-17370",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4780",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "51226",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/51226"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=bd3735ba584e7a49aee78813845245354b061f61",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=bd3735ba584e7a49aee78813845245354b061f61"
},
{
"name": "FEDORA-2011-17370",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"name": "MDVSA-2011:198",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "FEDORA-2011-17369",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4780",
"datePublished": "2011-12-22T20:00:00",
"dateReserved": "2011-12-13T00:00:00",
"dateUpdated": "2024-08-07T00:16:34.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6620
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95055 | vdb-entry, x_refsource_BID | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://www.phpmyadmin.net/security/PMASA-2016-43 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.338Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95055",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95055"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-43"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it\u0027s valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95055",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95055"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-43"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it\u0027s valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95055",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95055"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-43",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-43"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6620",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-4775
Vulnerability from cvelistv5
Published
2008-10-28 19:00
Modified
2024-08-07 10:31
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html | vendor-advisory, x_refsource_FEDORA | |
| http://security.gentoo.org/glsa/glsa-200903-32.xml | vendor-advisory, x_refsource_GENTOO | |
| http://secunia.com/advisories/32449 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46136 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/497815/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.vupen.com/english/advisories/2008/2943 | vdb-entry, x_refsource_VUPEN | |
| http://securityreason.com/securityalert/4516 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/31928 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/32482 | third-party-advisory, x_refsource_SECUNIA | |
| https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:31:27.174Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2008-9316",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "32449",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32449"
},
{
"name": "phpmyadmin-pmdpdf-xss(46136)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46136"
},
{
"name": "20081027 XSS in phpMyadmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/497815/100/0/threaded"
},
{
"name": "ADV-2008-2943",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2943"
},
{
"name": "4516",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4516"
},
{
"name": "31928",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31928"
},
{
"name": "32482",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32482"
},
{
"name": "FEDORA-2008-9336",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-10-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-11T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2008-9316",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "32449",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32449"
},
{
"name": "phpmyadmin-pmdpdf-xss(46136)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46136"
},
{
"name": "20081027 XSS in phpMyadmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/497815/100/0/threaded"
},
{
"name": "ADV-2008-2943",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2943"
},
{
"name": "4516",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4516"
},
{
"name": "31928",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31928"
},
{
"name": "32482",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32482"
},
{
"name": "FEDORA-2008-9336",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4775",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2008-9316",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html"
},
{
"name": "GLSA-200903-32",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "32449",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32449"
},
{
"name": "phpmyadmin-pmdpdf-xss(46136)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46136"
},
{
"name": "20081027 XSS in phpMyadmin",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/497815/100/0/threaded"
},
{
"name": "ADV-2008-2943",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2943"
},
{
"name": "4516",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4516"
},
{
"name": "31928",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31928"
},
{
"name": "32482",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32482"
},
{
"name": "FEDORA-2008-9336",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4775",
"datePublished": "2008-10-28T19:00:00",
"dateReserved": "2008-10-28T00:00:00",
"dateUpdated": "2024-08-07T10:31:27.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-4329
Vulnerability from cvelistv5
Published
2010-12-02 16:00
Modified
2024-08-07 03:43
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:43:14.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php"
},
{
"name": "MDVSA-2010:244",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:244"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45100",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/45100"
},
{
"name": "FEDORA-2010-18371",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "42477",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42477"
},
{
"name": "ADV-2010-3082",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/3082"
},
{
"name": "FEDORA-2010-18343",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html"
},
{
"name": "69516",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/69516"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4"
},
{
"name": "ADV-2010-3087",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/3087"
},
{
"name": "ADV-2010-3158",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/3158"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "42408",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/42408"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-11-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-12-07T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php"
},
{
"name": "MDVSA-2010:244",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:244"
},
{
"name": "ADV-2011-0001",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45100",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/45100"
},
{
"name": "FEDORA-2010-18371",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html"
},
{
"name": "DSA-2139",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "42477",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42477"
},
{
"name": "ADV-2010-3082",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/3082"
},
{
"name": "FEDORA-2010-18343",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html"
},
{
"name": "69516",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/69516"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4"
},
{
"name": "ADV-2010-3087",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/3087"
},
{
"name": "ADV-2010-3158",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/3158"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8"
},
{
"name": "42725",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42725"
},
{
"name": "42408",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/42408"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-4329",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php"
},
{
"name": "MDVSA-2010:244",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:244"
},
{
"name": "ADV-2011-0001",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"name": "45100",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/45100"
},
{
"name": "FEDORA-2010-18371",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html"
},
{
"name": "DSA-2139",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"name": "42477",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42477"
},
{
"name": "ADV-2010-3082",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/3082"
},
{
"name": "FEDORA-2010-18343",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html"
},
{
"name": "69516",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/69516"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4"
},
{
"name": "ADV-2010-3087",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/3087"
},
{
"name": "ADV-2010-3158",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/3158"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=4341818d73d454451f024950a4ce0141608ac7f8",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=4341818d73d454451f024950a4ce0141608ac7f8"
},
{
"name": "42725",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42725"
},
{
"name": "42408",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/42408"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-4329",
"datePublished": "2010-12-02T16:00:00",
"dateReserved": "2010-11-29T00:00:00",
"dateUpdated": "2024-08-07T03:43:14.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2719
Vulnerability from cvelistv5
Published
2011-08-01 19:00
Modified
2024-08-06 23:08
Severity ?
EPSS score ?
Summary
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.775Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7"
},
{
"name": "20110724 phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/518967/100/0/threaded"
},
{
"name": "20110724 phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2011/Jul/300"
},
{
"name": "20110804 Re: [Full-disclosure] phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/519155/100/0/threaded"
},
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45515"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725384"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "[oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"name": "74112",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/74112"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "8322",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8322"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "[oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"name": "phpmyadmin-swekey-file-overwrite(68769)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68769"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-07-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7"
},
{
"name": "20110724 phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/518967/100/0/threaded"
},
{
"name": "20110724 phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2011/Jul/300"
},
{
"name": "20110804 Re: [Full-disclosure] phpMyAdmin 3.x Conditional Session Manipulation",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/519155/100/0/threaded"
},
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45515"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725384"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "[oss-security] 20110726 Re: CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"name": "74112",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/74112"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "8322",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8322"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "[oss-security] 20110725 CVE-Request -- phpMyAdmin -- PMASA-2011-11 and PMASA-2011-12",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"name": "phpmyadmin-swekey-file-overwrite(68769)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68769"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2719",
"datePublished": "2011-08-01T19:00:00",
"dateReserved": "2011-07-11T00:00:00",
"dateUpdated": "2024-08-06T23:08:23.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4998
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-09-16 16:33
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.213Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-30T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4998",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4998",
"datePublished": "2013-07-30T18:00:00Z",
"dateReserved": "2013-07-29T00:00:00Z",
"dateUpdated": "2024-09-16T16:33:09.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5705
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.693Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-21/"
},
{
"name": "91378",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91378"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an \"invalid JSON\" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-21/"
},
{
"name": "91378",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91378"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5705",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an \"invalid JSON\" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-21/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-21/"
},
{
"name": "91378",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91378"
},
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5705",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-8326
Vulnerability from cvelistv5
Published
2014-11-05 11:00
Modified
2024-08-06 13:10
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/70731 | vdb-entry, x_refsource_BID | |
| http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:10:51.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c"
},
{
"name": "70731",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70731"
},
{
"name": "openSUSE-SU-2014:1347",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-04-28T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c"
},
{
"name": "70731",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70731"
},
{
"name": "openSUSE-SU-2014:1347",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8326",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c"
},
{
"name": "70731",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70731"
},
{
"name": "openSUSE-SU-2014:1347",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8326",
"datePublished": "2014-11-05T11:00:00",
"dateReserved": "2014-10-18T00:00:00",
"dateUpdated": "2024-08-06T13:10:51.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4349
Vulnerability from cvelistv5
Published
2005-12-19 11:00
Modified
2024-08-07 23:38
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450
References
| ▼ | URL | Tags |
|---|---|---|
| http://securityreason.com/securityalert/270 | third-party-advisory, x_refsource_SREASON | |
| http://www.vupen.com/english/advisories/2005/2995 | vdb-entry, x_refsource_VUPEN | |
| http://marc.info/?l=bugtraq&m=113486637512821&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/419829/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/18113 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/419832/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:38:51.895Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "270",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/270"
},
{
"name": "ADV-2005-2995",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2995"
},
{
"name": "20051217 phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113486637512821\u0026w=2"
},
{
"name": "20051219 Re: phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/419829/100/0/threaded"
},
{
"name": "18113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18113"
},
{
"name": "20051219 about phpMyAdmin\u0027s server_privileges.php announced vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/419832/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "270",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/270"
},
{
"name": "ADV-2005-2995",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2995"
},
{
"name": "20051217 phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113486637512821\u0026w=2"
},
{
"name": "20051219 Re: phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/419829/100/0/threaded"
},
{
"name": "18113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18113"
},
{
"name": "20051219 about phpMyAdmin\u0027s server_privileges.php announced vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/419832/100/0/threaded"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4349",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "270",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/270"
},
{
"name": "ADV-2005-2995",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2995"
},
{
"name": "20051217 phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=113486637512821\u0026w=2"
},
{
"name": "20051219 Re: phpMyAdmin server_privileges.php SQL Injection Vulnerabilities.",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/419829/100/0/threaded"
},
{
"name": "18113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18113"
},
{
"name": "20051219 about phpMyAdmin\u0027s server_privileges.php announced vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/419832/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4349",
"datePublished": "2005-12-19T11:00:00",
"dateReserved": "2005-12-19T00:00:00",
"dateUpdated": "2024-08-07T23:38:51.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2507
Vulnerability from cvelistv5
Published
2011-07-14 23:00
Modified
2024-08-06 23:00
Severity ?
EPSS score ?
Summary
libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.267Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=69fb0f8e7dc38075427aceaf09bcac697d0590ff"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45139"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "73613",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/73613"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=69fb0f8e7dc38075427aceaf09bcac697d0590ff"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45139"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "73613",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/73613"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-2507",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt",
"refsource": "MISC",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=69fb0f8e7dc38075427aceaf09bcac697d0590ff",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=69fb0f8e7dc38075427aceaf09bcac697d0590ff"
},
{
"name": "45139",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45139"
},
{
"name": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html",
"refsource": "MISC",
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html"
},
{
"name": "DSA-2286",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html",
"refsource": "MISC",
"url": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "73613",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/73613"
},
{
"name": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html",
"refsource": "MISC",
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2507",
"datePublished": "2011-07-14T23:00:00",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000016
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2017-5 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:05.876Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-13T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-5"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.267982",
"ID": "CVE-2017-1000016",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-5",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-5"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000016",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:05.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2643
Vulnerability from cvelistv5
Published
2011-08-01 19:00
Modified
2024-08-06 23:08
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/45515 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/45365 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/48874 | vdb-entry, x_refsource_BID | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:124 | vendor-advisory, x_refsource_MANDRIVA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/68767 | vdb-entry, x_refsource_XF | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html | vendor-advisory, x_refsource_FEDORA | |
| https://bugzilla.redhat.com/show_bug.cgi?id=725382 | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html | vendor-advisory, x_refsource_FEDORA | |
| http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:08:23.678Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php"
},
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "phpmyadmin-mimetype-file-include(68767)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68767"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725382"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-07-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php"
},
{
"name": "45515",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45365"
},
{
"name": "48874",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "phpmyadmin-mimetype-file-include(68767)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68767"
},
{
"name": "FEDORA-2011-9725",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725382"
},
{
"name": "FEDORA-2011-9734",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-2643",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php"
},
{
"name": "45515",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45515"
},
{
"name": "45365",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45365"
},
{
"name": "48874",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "phpmyadmin-mimetype-file-include(68767)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68767"
},
{
"name": "FEDORA-2011-9725",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=725382",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725382"
},
{
"name": "FEDORA-2011-9734",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-2643",
"datePublished": "2011-08-01T19:00:00",
"dateReserved": "2011-07-06T00:00:00",
"dateUpdated": "2024-08-06T23:08:23.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5732
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:07
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-25/ | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-25/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-25/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5732",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-25/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-25/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5732",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-21T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-11441
Vulnerability from cvelistv5
Published
2020-03-31 16:50
Modified
2024-08-04 11:28
Severity ?
EPSS score ?
Summary
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/issues/16056 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:28:13.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/16056"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states \"I don\u0027t see anything specifically exploitable."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-01T12:33:51",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/16056"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-11441",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states \"I don\u0027t see anything specifically exploitable.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/issues/16056",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/16056"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-11441",
"datePublished": "2020-03-31T16:50:23",
"dateReserved": "2020-03-31T00:00:00",
"dateUpdated": "2024-08-04T11:28:13.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3592
Vulnerability from cvelistv5
Published
2014-12-26 02:00
Modified
2024-08-06 23:37
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2011/09/30/8 | mailing-list, x_refsource_MLIST | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=738681 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:37:48.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6"
},
{
"name": "[oss-security] 20110930 Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-12-26T02:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6"
},
{
"name": "[oss-security] 20110930 Re: CVE Request --- phpMyAdmin -- Multiple XSS flaws in versions v3.4.0 to v3.4.4 (PMASA-2011-14)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-3592",
"datePublished": "2014-12-26T02:00:00",
"dateReserved": "2011-09-21T00:00:00",
"dateUpdated": "2024-08-06T23:37:48.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-5504
Vulnerability from cvelistv5
Published
2020-01-09 21:56
Modified
2024-08-04 08:30
Severity ?
EPSS score ?
Summary
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2020-1/ | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html | vendor-advisory, x_refsource_SUSE | |
| https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html | mailing-list, x_refsource_MLIST | |
| https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:30:24.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-1/"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "[debian-lts-announce] 20200115 [SECURITY] [DLA 2060-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-29T19:54:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-1/"
},
{
"name": "openSUSE-SU-2020:0056",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "[debian-lts-announce] 20200115 [SECURITY] [DLA 2060-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-5504",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-1/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-1/"
},
{
"name": "openSUSE-SU-2020:0056",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"name": "[debian-lts-announce] 20200115 [SECURITY] [DLA 2060-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"
},
{
"name": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html",
"refsource": "MISC",
"url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-5504",
"datePublished": "2020-01-09T21:56:22",
"dateReserved": "2020-01-05T00:00:00",
"dateUpdated": "2024-08-04T08:30:24.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-7251
Vulnerability from cvelistv5
Published
2010-01-19 16:00
Modified
2024-08-07 11:56
Severity ?
EPSS score ?
Summary
libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/38211 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/39503 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html | vendor-advisory, x_refsource_SUSE | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=11536 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2010/0910 | vdb-entry, x_refsource_VUPEN | |
| http://www.debian.org/security/2010/dsa-2034 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/37826 | vdb-entry, x_refsource_BID | |
| http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536&r2=11535&pathrev=11536 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:56:14.607Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php"
},
{
"name": "37826",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/37826"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-01-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-01-28T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "38211",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536"
},
{
"name": "ADV-2010-0910",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"name": "DSA-2034",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php"
},
{
"name": "37826",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/37826"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-7251",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "38211",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/38211"
},
{
"name": "39503",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/39503"
},
{
"name": "SUSE-SR:2010:001",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536"
},
{
"name": "ADV-2010-0910",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"name": "DSA-2034",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php"
},
{
"name": "37826",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/37826"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-7251",
"datePublished": "2010-01-19T16:00:00",
"dateReserved": "2010-01-12T00:00:00",
"dateUpdated": "2024-08-07T11:56:14.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5703
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:07
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3 | x_refsource_CONFIRM | |
| https://www.phpmyadmin.net/security/PMASA-2016-19/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/91381 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-19/"
},
{
"name": "91381",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91381"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-19/"
},
{
"name": "91381",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91381"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5703",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-19/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-19/"
},
{
"name": "91381",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91381"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5703",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-5339
Vulnerability from cvelistv5
Published
2012-10-25 10:00
Modified
2024-08-06 21:05
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/55925 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186 | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:47.212Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "55925",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55925"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611"
},
{
"name": "openSUSE-SU-2012:1507",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-10-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-05T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "55925",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55925"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611"
},
{
"name": "openSUSE-SU-2012:1507",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5339",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "55925",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55925"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611"
},
{
"name": "openSUSE-SU-2012:1507",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5339",
"datePublished": "2012-10-25T10:00:00",
"dateReserved": "2012-10-08T00:00:00",
"dateUpdated": "2024-08-06T21:05:47.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-1395
Vulnerability from cvelistv5
Published
2007-03-10 22:00
Modified
2024-08-07 12:50
Severity ?
EPSS score ?
Summary
Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/32858 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/26733 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/35048 | vdb-entry, x_refsource_OSVDB | |
| http://securityreason.com/securityalert/2402 | third-party-advisory, x_refsource_SREASON | |
| http://www.virtuax.be/advisories/Advisory2-24012007.txt | x_refsource_MISC | |
| http://www.us.debian.org/security/2007/dsa-1370 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA | |
| http://www.securityfocus.com/archive/1/462139/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:50:35.229Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-dbtable-xss(32858)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32858"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "35048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35048"
},
{
"name": "2402",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2402"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.virtuax.be/advisories/Advisory2-24012007.txt"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "20070307 xss in phpmyadmin \u003e=2.8.0 and \u003c 2.10.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/462139/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase \u003c/SCRIPT\u003e end tag, which bypasses the protection against lowercase \u003c/script\u003e."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-dbtable-xss(32858)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32858"
},
{
"name": "26733",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26733"
},
{
"name": "35048",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35048"
},
{
"name": "2402",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2402"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.virtuax.be/advisories/Advisory2-24012007.txt"
},
{
"name": "DSA-1370",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "20070307 xss in phpmyadmin \u003e=2.8.0 and \u003c 2.10.0",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/462139/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1395",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase \u003c/SCRIPT\u003e end tag, which bypasses the protection against lowercase \u003c/script\u003e."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-dbtable-xss(32858)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32858"
},
{
"name": "26733",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26733"
},
{
"name": "35048",
"refsource": "OSVDB",
"url": "http://osvdb.org/35048"
},
{
"name": "2402",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2402"
},
{
"name": "http://www.virtuax.be/advisories/Advisory2-24012007.txt",
"refsource": "MISC",
"url": "http://www.virtuax.be/advisories/Advisory2-24012007.txt"
},
{
"name": "DSA-1370",
"refsource": "DEBIAN",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "20070307 xss in phpmyadmin \u003e=2.8.0 and \u003c 2.10.0",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/462139/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1395",
"datePublished": "2007-03-10T22:00:00",
"dateReserved": "2007-03-10T00:00:00",
"dateUpdated": "2024-08-07T12:50:35.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-12581
Vulnerability from cvelistv5
Published
2018-06-21 20:00
Modified
2024-08-05 08:38
Severity ?
EPSS score ?
Summary
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/104530 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1041187 | vdb-entry, x_refsource_SECTRACK | |
| https://www.phpmyadmin.net/security/PMASA-2018-3/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T08:38:06.323Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "104530",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/104530"
},
{
"name": "1041187",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041187"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-3/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-06-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-06-30T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "104530",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/104530"
},
{
"name": "1041187",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041187"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-3/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-12581",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "104530",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/104530"
},
{
"name": "1041187",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041187"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-3/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-3/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-12581",
"datePublished": "2018-06-21T20:00:00",
"dateReserved": "2018-06-19T00:00:00",
"dateUpdated": "2024-08-05T08:38:06.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-3696
Vulnerability from cvelistv5
Published
2009-10-16 16:00
Modified
2024-08-07 06:38
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:38:29.532Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "phpmyadmin-tablename-xss(53742)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53742"
},
{
"name": "FEDORA-2009-10530",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "FEDORA-2009-10510",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "phpmyadmin-tablename-xss(53742)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53742"
},
{
"name": "FEDORA-2009-10530",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "FEDORA-2009-10510",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3696",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/",
"refsource": "CONFIRM",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"name": "http://freshmeat.net/projects/phpmyadmin/releases/306667",
"refsource": "CONFIRM",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "phpmyadmin-tablename-xss(53742)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53742"
},
{
"name": "FEDORA-2009-10530",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"name": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html",
"refsource": "CONFIRM",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=528769",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"name": "http://freshmeat.net/projects/phpmyadmin/releases/306669",
"refsource": "CONFIRM",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "FEDORA-2009-10510",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"name": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html",
"refsource": "CONFIRM",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=288899",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3696",
"datePublished": "2009-10-16T16:00:00",
"dateReserved": "2009-10-13T00:00:00",
"dateUpdated": "2024-08-07T06:38:29.532Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000015
Vulnerability from cvelistv5
Published
2017-07-13 20:00
Modified
2024-08-05 21:53
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95726 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2017-4 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:53:06.310Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95726",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95726"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-05-06T00:00:00",
"datePublic": "2017-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-27T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95726",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95726"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-05-06T20:43:28.267196",
"ID": "CVE-2017-1000015",
"REQUESTER": "security@phpmyadmin.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95726",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95726"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2017-4",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000015",
"datePublished": "2017-07-13T20:00:00",
"dateReserved": "2017-07-10T00:00:00",
"dateUpdated": "2024-08-05T21:53:06.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-7260
Vulnerability from cvelistv5
Published
2018-02-21 15:00
Modified
2024-08-05 06:24
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
References
| ▼ | URL | Tags |
|---|---|---|
| https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/ | x_refsource_MISC | |
| http://www.securityfocus.com/bid/103099 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2018-1/ | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:24:11.833Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"name": "103099",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103099"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-26T19:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"name": "103099",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103099"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7260",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/",
"refsource": "MISC",
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"name": "103099",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103099"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-1/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7260",
"datePublished": "2018-02-21T15:00:00",
"dateReserved": "2018-02-19T00:00:00",
"dateUpdated": "2024-08-05T06:24:11.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0204
Vulnerability from cvelistv5
Published
2007-01-11 11:00
Modified
2024-08-07 12:12
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31387 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/32667 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/21987 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/23702 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 | x_refsource_MISC | |
| http://www.vupen.com/english/advisories/2007/0125 | vdb-entry, x_refsource_VUPEN | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:12:17.561Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-unspecified-xss(31387)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31387"
},
{
"name": "32667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32667"
},
{
"name": "21987",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23702"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-0125",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-unspecified-xss(31387)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31387"
},
{
"name": "32667",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32667"
},
{
"name": "21987",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23702"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-0125",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-unspecified-xss(31387)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31387"
},
{
"name": "32667",
"refsource": "OSVDB",
"url": "http://osvdb.org/32667"
},
{
"name": "21987",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"name": "23702",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23702"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "MISC",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "ADV-2007-0125",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0204",
"datePublished": "2007-01-11T11:00:00",
"dateReserved": "2007-01-10T00:00:00",
"dateUpdated": "2024-08-07T12:12:17.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-1392
Vulnerability from cvelistv5
Published
2005-05-02 04:00
Modified
2024-08-07 21:51
Severity ?
EPSS score ?
Summary
The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.osvdb.org/16053 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2005/0436 | vdb-entry, x_refsource_VUPEN | |
| http://bugs.gentoo.org/show_bug.cgi?id=88831 | x_refsource_CONFIRM | |
| http://security.gentoo.org/glsa/glsa-200504-30.xml | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:51:50.275Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "16053",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/16053"
},
{
"name": "ADV-2005-0436",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/0436"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=88831"
},
{
"name": "GLSA-200504-30",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200504-30.xml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-04-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-02-26T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "16053",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/16053"
},
{
"name": "ADV-2005-0436",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/0436"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=88831"
},
{
"name": "GLSA-200504-30",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200504-30.xml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-1392",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "16053",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/16053"
},
{
"name": "ADV-2005-0436",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/0436"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=88831",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=88831"
},
{
"name": "GLSA-200504-30",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200504-30.xml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-1392",
"datePublished": "2005-05-02T04:00:00",
"dateReserved": "2005-05-02T00:00:00",
"dateUpdated": "2024-08-07T21:51:50.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-1151
Vulnerability from cvelistv5
Published
2009-03-26 14:00
Modified
2024-08-07 05:04
Severity ?
EPSS score ?
Summary
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T05:04:48.303Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
},
{
"name": "GLSA-200906-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34642"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/"
},
{
"name": "20090609 CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/504191/100/0/threaded"
},
{
"name": "DSA-1824",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34236",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/34236"
},
{
"name": "34430",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35635"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301"
},
{
"name": "8921",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/8921"
},
{
"name": "35585",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/35585"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
},
{
"name": "GLSA-200906-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"name": "34642",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34642"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/"
},
{
"name": "20090609 CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/504191/100/0/threaded"
},
{
"name": "DSA-1824",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34236",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/34236"
},
{
"name": "34430",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35635"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301"
},
{
"name": "8921",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/8921"
},
{
"name": "35585",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/35585"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-1151",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
},
{
"name": "GLSA-200906-03",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"name": "34642",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34642"
},
{
"name": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/",
"refsource": "MISC",
"url": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/"
},
{
"name": "20090609 CVE-2009-1151: phpMyAdmin Remote Code Execution Proof of Concept",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/504191/100/0/threaded"
},
{
"name": "DSA-1824",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"name": "SUSE-SR:2009:008",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"name": "MDVSA-2009:115",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"name": "34236",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/34236"
},
{
"name": "34430",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/34430"
},
{
"name": "35635",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35635"
},
{
"name": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301"
},
{
"name": "8921",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/8921"
},
{
"name": "35585",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/35585"
},
{
"name": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/",
"refsource": "MISC",
"url": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-1151",
"datePublished": "2009-03-26T14:00:00",
"dateReserved": "2009-03-26T00:00:00",
"dateUpdated": "2024-08-07T05:04:48.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-8960
Vulnerability from cvelistv5
Published
2014-11-30 11:00
Modified
2024-08-06 13:33
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/71244 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2014:228 | vendor-advisory, x_refsource_MANDRIVA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:33:12.650Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233"
},
{
"name": "71244",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/71244"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-20T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233"
},
{
"name": "71244",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/71244"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php"
},
{
"name": "MDVSA-2014:228",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8960",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "openSUSE-SU-2014:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233"
},
{
"name": "71244",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/71244"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php"
},
{
"name": "MDVSA-2014:228",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8960",
"datePublished": "2014-11-30T11:00:00",
"dateReserved": "2014-11-18T00:00:00",
"dateUpdated": "2024-08-06T13:33:12.650Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-5621
Vulnerability from cvelistv5
Published
2008-12-17 02:00
Modified
2024-08-07 10:56
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:56:47.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-3501",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3501"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "DSA-1723",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2009/dsa-1723"
},
{
"name": "phpmyadmin-tblstructure-csrf(47168)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47168"
},
{
"name": "4753",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4753"
},
{
"name": "ADV-2008-3402",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3402"
},
{
"name": "50894",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/50894"
},
{
"name": "FEDORA-2008-11221",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html"
},
{
"name": "33146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33146"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "33246",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33246"
},
{
"name": "[oss-security] 20090212 CVE-2008-5621 is a duplicate (was: Re: CVE request: phpMyAdmin \u003c 3.1.1.0 (SQL injection through XSRF on several pages ))",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/02/12/1"
},
{
"name": "32720",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/32720"
},
{
"name": "33912",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33912"
},
{
"name": "7382",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/7382"
},
{
"name": "33076",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33076"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-12-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-3501",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3501"
},
{
"name": "GLSA-200903-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "DSA-1723",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2009/dsa-1723"
},
{
"name": "phpmyadmin-tblstructure-csrf(47168)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47168"
},
{
"name": "4753",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4753"
},
{
"name": "ADV-2008-3402",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3402"
},
{
"name": "50894",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/50894"
},
{
"name": "FEDORA-2008-11221",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html"
},
{
"name": "33146",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33146"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "33246",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33246"
},
{
"name": "[oss-security] 20090212 CVE-2008-5621 is a duplicate (was: Re: CVE request: phpMyAdmin \u003c 3.1.1.0 (SQL injection through XSRF on several pages ))",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/02/12/1"
},
{
"name": "32720",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/32720"
},
{
"name": "33912",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33912"
},
{
"name": "7382",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/7382"
},
{
"name": "33076",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33076"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-5621",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "ADV-2008-3501",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3501"
},
{
"name": "GLSA-200903-32",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"name": "DSA-1723",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2009/dsa-1723"
},
{
"name": "phpmyadmin-tblstructure-csrf(47168)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47168"
},
{
"name": "4753",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4753"
},
{
"name": "ADV-2008-3402",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3402"
},
{
"name": "50894",
"refsource": "OSVDB",
"url": "http://osvdb.org/50894"
},
{
"name": "FEDORA-2008-11221",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html"
},
{
"name": "33146",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33146"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "33246",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33246"
},
{
"name": "[oss-security] 20090212 CVE-2008-5621 is a duplicate (was: Re: CVE request: phpMyAdmin \u003c 3.1.1.0 (SQL injection through XSRF on several pages ))",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/02/12/1"
},
{
"name": "32720",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/32720"
},
{
"name": "33912",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33912"
},
{
"name": "7382",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/7382"
},
{
"name": "33076",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33076"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-5621",
"datePublished": "2008-12-17T02:00:00",
"dateReserved": "2008-12-16T00:00:00",
"dateUpdated": "2024-08-07T10:56:47.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9854
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-63 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94527 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9854",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9854",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6625
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-48 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/92491 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-48"
},
{
"name": "92491",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92491"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user\u0027s session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-48"
},
{
"name": "92491",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92491"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6625",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user\u0027s session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-48",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-48"
},
{
"name": "92491",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92491"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6625",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6613
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-36 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94115 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.683Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-36"
},
{
"name": "94115",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94115"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:05",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-36"
},
{
"name": "94115",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94115"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6613",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-36",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-36"
},
{
"name": "94115",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94115"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6613",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-4579
Vulnerability from cvelistv5
Published
2012-08-21 23:00
Modified
2024-09-16 17:27
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:42:54.600Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-21T23:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4579",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4579",
"datePublished": "2012-08-21T23:00:00Z",
"dateReserved": "2012-08-21T00:00:00Z",
"dateUpdated": "2024-09-16T17:27:35.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-23808
Vulnerability from cvelistv5
Published
2022-01-22 00:00
Modified
2024-08-03 03:51
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:51:46.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-2/"
},
{
"tags": [
"x_transferred"
],
"url": "https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-26T12:06:13.311845",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.phpmyadmin.net/security/PMASA-2022-2/"
},
{
"url": "https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-23808",
"datePublished": "2022-01-22T00:00:00",
"dateReserved": "2022-01-21T00:00:00",
"dateUpdated": "2024-08-03T03:51:46.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-0813
Vulnerability from cvelistv5
Published
2022-03-09 14:59
Modified
2024-09-16 23:51
Severity ?
EPSS score ?
Summary
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | phpMyAdmin | phpMyAdmin |
Version: 5.1.1 < |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.300Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released/"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "phpMyAdmin",
"vendor": "phpMyAdmin",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Rafael Pedrero"
}
],
"datePublic": "2022-03-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-26T12:06:10.507240",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information"
},
{
"url": "https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released/"
},
{
"name": "GLSA-202311-17",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202311-17"
}
],
"solutions": [
{
"lang": "en",
"value": "This vulnerability has been solved by the phpMyAdmin team in the 5.1.3 version."
}
],
"source": {
"defect": [
"INCIBE-2022-0636"
],
"discovery": "EXTERNAL"
},
"title": "PhpMyAdmin exposure of sensitive information",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2022-0813",
"datePublished": "2022-03-09T14:59:28.954074Z",
"dateReserved": "2022-03-01T00:00:00",
"dateUpdated": "2024-09-16T23:51:38.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2505
Vulnerability from cvelistv5
Published
2011-07-14 23:00
Modified
2024-08-06 23:00
Severity ?
EPSS score ?
Summary
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.116Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45139"
},
{
"name": "73611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/73611"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967"
},
{
"name": "17514",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a \"remote variable manipulation vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45139"
},
{
"name": "73611",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/73611"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967"
},
{
"name": "17514",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-2505",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a \"remote variable manipulation vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt",
"refsource": "MISC",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "45292",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php"
},
{
"name": "45139",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45139"
},
{
"name": "73611",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/73611"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967"
},
{
"name": "17514",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html",
"refsource": "MISC",
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2505",
"datePublished": "2011-07-14T23:00:00",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1147
Vulnerability from cvelistv5
Published
2004-12-15 05:00
Modified
2024-08-08 00:39
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/18441 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=110295781828323&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.exaprobe.com/labs/advisories/esa-2004-1213.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:39:00.904Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phpmyadmin-command-execute(18441)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-12-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phpmyadmin-command-execute(18441)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1147",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phpmyadmin-command-execute(18441)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"name": "20041213 Multiple vulnerabilities in phpMyAdmin",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"name": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html",
"refsource": "MISC",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1147",
"datePublished": "2004-12-15T05:00:00",
"dateReserved": "2004-12-06T00:00:00",
"dateUpdated": "2024-08-08T00:39:00.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9864
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-69 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/94533 | vdb-entry, x_refsource_BID | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.561Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-69"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94533",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94533"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-69"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94533",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94533"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9864",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-69",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-69"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94533",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94533"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9864",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4986
Vulnerability from cvelistv5
Published
2014-07-20 10:00
Modified
2024-08-06 11:34
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html | vendor-advisory, x_refsource_SUSE | |
| https://security.gentoo.org/glsa/201505-03 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/68803 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/60397 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:34:37.126Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "68803",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68803"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-07-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-20T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1069",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "68803",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68803"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php"
},
{
"name": "60397",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60397"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4986",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1069",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"name": "GLSA-201505-03",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"name": "68803",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68803"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php"
},
{
"name": "60397",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60397"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4986",
"datePublished": "2014-07-20T10:00:00",
"dateReserved": "2014-07-16T00:00:00",
"dateUpdated": "2024-08-06T11:34:37.126Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-3697
Vulnerability from cvelistv5
Published
2009-10-16 16:00
Modified
2024-08-07 06:38
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T06:38:30.267Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "FEDORA-2009-10530",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "phpmyadmin-pdf-sql-injection(53741)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53741"
},
{
"name": "FEDORA-2009-10510",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-10-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "FEDORA-2009-10530",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "phpmyadmin-pdf-sql-injection(53741)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53741"
},
{
"name": "FEDORA-2009-10510",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-3697",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/",
"refsource": "CONFIRM",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"name": "http://freshmeat.net/projects/phpmyadmin/releases/306667",
"refsource": "CONFIRM",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"name": "FEDORA-2009-10530",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"name": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html",
"refsource": "CONFIRM",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=528769",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"name": "[oss-security] 20091014 CVE Request -- phpMyAdmin",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"name": "http://freshmeat.net/projects/phpmyadmin/releases/306669",
"refsource": "CONFIRM",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"name": "[oss-security] 20091015 Re: CVE Request -- phpMyAdmin",
"refsource": "MLIST",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"name": "phpmyadmin-pdf-sql-injection(53741)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53741"
},
{
"name": "FEDORA-2009-10510",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"name": "ADV-2009-2899",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"name": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html",
"refsource": "CONFIRM",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"name": "http://bugs.gentoo.org/show_bug.cgi?id=288899",
"refsource": "CONFIRM",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"name": "36658",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"name": "SUSE-SR:2009:017",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"name": "37016",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/37016"
},
{
"name": "MDVSA-2009:274",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-3697",
"datePublished": "2009-10-16T16:00:00",
"dateReserved": "2009-10-13T00:00:00",
"dateUpdated": "2024-08-07T06:38:30.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3056
Vulnerability from cvelistv5
Published
2010-08-24 19:00
Modified
2024-08-07 02:55
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:55:46.481Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2010-13249",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29"
},
{
"name": "FEDORA-2010-13258",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html"
},
{
"name": "41000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41000"
},
{
"name": "ADV-2010-2231",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=625877"
},
{
"name": "MDVSA-2010:163",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"name": "MDVSA-2010:164",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:164"
},
{
"name": "42584",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/42584"
},
{
"name": "ADV-2010-2223",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/41185"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-08-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-09-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2010-13249",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29"
},
{
"name": "FEDORA-2010-13258",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html"
},
{
"name": "41000",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41000"
},
{
"name": "ADV-2010-2231",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=625877"
},
{
"name": "MDVSA-2010:163",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"name": "MDVSA-2010:164",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:164"
},
{
"name": "42584",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/42584"
},
{
"name": "ADV-2010-2223",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/41185"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3056",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2010-13249",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php"
},
{
"name": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29",
"refsource": "MISC",
"url": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29"
},
{
"name": "FEDORA-2010-13258",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html"
},
{
"name": "41000",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41000"
},
{
"name": "ADV-2010-2231",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"name": "DSA-2097",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=625877",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=625877"
},
{
"name": "MDVSA-2010:163",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"name": "MDVSA-2010:164",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:164"
},
{
"name": "42584",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/42584"
},
{
"name": "ADV-2010-2223",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"name": "41185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/41185"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3056",
"datePublished": "2010-08-24T19:00:00",
"dateReserved": "2010-08-19T00:00:00",
"dateUpdated": "2024-08-07T02:55:46.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-5029
Vulnerability from cvelistv5
Published
2013-08-19 23:00
Modified
2024-09-16 20:42
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b | x_refsource_MISC | |
| http://secunia.com/advisories/54488 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b | x_refsource_MISC | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7 | x_refsource_MISC | |
| https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.310Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2013:1343",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b"
},
{
"name": "54488",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/54488"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-19T23:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2013:1343",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b"
},
{
"name": "54488",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/54488"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2013:1343",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b"
},
{
"name": "54488",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/54488"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f",
"refsource": "MISC",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5029",
"datePublished": "2013-08-19T23:00:00Z",
"dateReserved": "2013-07-31T00:00:00Z",
"dateUpdated": "2024-09-16T20:42:13.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3742
Vulnerability from cvelistv5
Published
2013-07-04 10:00
Modified
2024-09-17 03:07
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf | x_refsource_CONFIRM | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:22:00.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-07-04T10:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3742",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3742",
"datePublished": "2013-07-04T10:00:00Z",
"dateReserved": "2013-06-03T00:00:00Z",
"dateUpdated": "2024-09-17T03:07:52.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9859
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94525 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://www.phpmyadmin.net/security/PMASA-2016-65 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.625Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94525",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9859",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94525",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94525"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-65",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9859",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-1567
Vulnerability from cvelistv5
Published
2008-03-31 22:00
Modified
2024-08-07 08:24
Severity ?
EPSS score ?
Summary
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:24:42.736Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "28560",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28560"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/30816"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408"
},
{
"name": "FEDORA-2008-2874",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html"
},
{
"name": "29613",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29613"
},
{
"name": "29588",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29588"
},
{
"name": "FEDORA-2008-2825",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "phpmyadmin-sessiondata-info-disclosure(41541)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41541"
},
{
"name": "ADV-2008-1037",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/1037/references"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-03-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "28560",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28560"
},
{
"name": "SUSE-SR:2009:003",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "DSA-1557",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/30816"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408"
},
{
"name": "FEDORA-2008-2874",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html"
},
{
"name": "29613",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29613"
},
{
"name": "29588",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29588"
},
{
"name": "FEDORA-2008-2825",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2"
},
{
"name": "33822",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/33822"
},
{
"name": "phpmyadmin-sessiondata-info-disclosure(41541)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41541"
},
{
"name": "ADV-2008-1037",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/1037/references"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1567",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "28560",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28560"
},
{
"name": "SUSE-SR:2009:003",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"name": "DSA-1557",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"name": "32834",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32834"
},
{
"name": "29964",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29964"
},
{
"name": "30816",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/30816"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408",
"refsource": "MISC",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408"
},
{
"name": "FEDORA-2008-2874",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html"
},
{
"name": "29613",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29613"
},
{
"name": "29588",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29588"
},
{
"name": "FEDORA-2008-2825",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2"
},
{
"name": "33822",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/33822"
},
{
"name": "phpmyadmin-sessiondata-info-disclosure(41541)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41541"
},
{
"name": "ADV-2008-1037",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/1037/references"
},
{
"name": "SUSE-SR:2008:026",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"name": "MDVSA-2008:131",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1567",
"datePublished": "2008-03-31T22:00:00",
"dateReserved": "2008-03-31T00:00:00",
"dateUpdated": "2024-08-07T08:24:42.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10804
Vulnerability from cvelistv5
Published
2020-03-22 03:47
Modified
2024-08-04 11:14
Severity ?
EPSS score ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2020-2/ | x_refsource_MISC | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html | vendor-advisory, x_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html | vendor-advisory, x_refsource_SUSE | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/ | vendor-advisory, x_refsource_FEDORA | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/ | vendor-advisory, x_refsource_FEDORA | |
| http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:14:15.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-2/"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-11-01T18:06:15",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-2/"
},
{
"name": "openSUSE-SU-2020:0405",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10804",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2020-2/",
"refsource": "MISC",
"url": "https://www.phpmyadmin.net/security/PMASA-2020-2/"
},
{
"name": "openSUSE-SU-2020:0405",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"name": "openSUSE-SU-2020:0427",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"name": "FEDORA-2020-d7b0a5a84a",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"name": "FEDORA-2020-25f3aea389",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"name": "FEDORA-2020-e60ce63865",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"name": "openSUSE-SU-2020:1806",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10804",
"datePublished": "2020-03-22T03:47:59",
"dateReserved": "2020-03-22T00:00:00",
"dateUpdated": "2024-08-04T11:14:15.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9852
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-63 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94527 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.577Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9852",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9852",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2560
Vulnerability from cvelistv5
Published
2016-03-01 11:00
Modified
2024-08-05 23:32
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:32:21.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-11/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32"
},
{
"name": "openSUSE-SU-2016:0666",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078"
},
{
"name": "openSUSE-SU-2016:0663",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-02-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-01T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2016-65da02b95c",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-11/"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc"
},
{
"name": "FEDORA-2016-02ee5b4002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32"
},
{
"name": "openSUSE-SU-2016:0666",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078"
},
{
"name": "openSUSE-SU-2016:0663",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2560",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2016-65da02b95c",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-11/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-11/"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc"
},
{
"name": "FEDORA-2016-02ee5b4002",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32"
},
{
"name": "openSUSE-SU-2016:0666",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078"
},
{
"name": "openSUSE-SU-2016:0663",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2560",
"datePublished": "2016-03-01T11:00:00",
"dateReserved": "2016-02-25T00:00:00",
"dateUpdated": "2024-08-05T23:32:21.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-0987
Vulnerability from cvelistv5
Published
2011-02-14 21:00
Modified
2024-08-06 22:14
Severity ?
EPSS score ?
Summary
The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T22:14:26.526Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2011-0512",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0512"
},
{
"name": "ADV-2011-0570",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0570"
},
{
"name": "FEDORA-2011-1282",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0"
},
{
"name": "ADV-2011-0409",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0409"
},
{
"name": "ADV-2011-0381",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0381"
},
{
"name": "ADV-2011-0385",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "43391",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43391"
},
{
"name": "phpmyadmin-bookmark-security-bypass(65390)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65390"
},
{
"name": "FEDORA-2011-1408",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "DSA-2167",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2167"
},
{
"name": "MDVSA-2011:026",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "46359",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/46359"
},
{
"name": "FEDORA-2011-1373",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"name": "43324",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43324"
},
{
"name": "43478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/43478"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-02-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user\u0027s execution of a SQL query by creating a bookmark."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2011-0512",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0512"
},
{
"name": "ADV-2011-0570",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0570"
},
{
"name": "FEDORA-2011-1282",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0"
},
{
"name": "ADV-2011-0409",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0409"
},
{
"name": "ADV-2011-0381",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0381"
},
{
"name": "ADV-2011-0385",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "43391",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43391"
},
{
"name": "phpmyadmin-bookmark-security-bypass(65390)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65390"
},
{
"name": "FEDORA-2011-1408",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "DSA-2167",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2167"
},
{
"name": "MDVSA-2011:026",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "46359",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/46359"
},
{
"name": "FEDORA-2011-1373",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"name": "43324",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43324"
},
{
"name": "43478",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/43478"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-0987",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user\u0027s execution of a SQL query by creating a bookmark."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2011-0512",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0512"
},
{
"name": "ADV-2011-0570",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0570"
},
{
"name": "FEDORA-2011-1282",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0"
},
{
"name": "ADV-2011-0409",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0409"
},
{
"name": "ADV-2011-0381",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0381"
},
{
"name": "ADV-2011-0385",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"name": "43391",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43391"
},
{
"name": "phpmyadmin-bookmark-security-bypass(65390)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65390"
},
{
"name": "FEDORA-2011-1408",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"name": "DSA-2167",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2167"
},
{
"name": "MDVSA-2011:026",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"name": "46359",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/46359"
},
{
"name": "FEDORA-2011-1373",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"name": "43324",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43324"
},
{
"name": "43478",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/43478"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-0987",
"datePublished": "2011-02-14T21:00:00",
"dateReserved": "2011-02-11T00:00:00",
"dateUpdated": "2024-08-06T22:14:26.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19969
Vulnerability from cvelistv5
Published
2018-12-11 17:00
Modified
2024-08-05 11:51
Severity ?
EPSS score ?
Summary
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/106175 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2018-7/ | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201904-16 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:51:17.881Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "106175",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106175"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-7/"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-12-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-15T22:06:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "106175",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106175"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-7/"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19969",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106175",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106175"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-7/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-7/"
},
{
"name": "GLSA-201904-16",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201904-16"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19969",
"datePublished": "2018-12-11T17:00:00",
"dateReserved": "2018-12-07T00:00:00",
"dateUpdated": "2024-08-05T11:51:17.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-5718
Vulnerability from cvelistv5
Published
2006-11-04 01:00
Modified
2024-08-07 20:04
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/20856 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2006/4298 | vdb-entry, x_refsource_VUPEN | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/29957 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/450397/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/22599 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/23086 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html | vendor-advisory, x_refsource_SUSE | |
| http://www.hardened-php.net/advisory_122006.137.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:04:54.294Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20856",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/20856"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6"
},
{
"name": "ADV-2006-4298",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/4298"
},
{
"name": "phpmyadmin-utf7-xss(29957)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29957"
},
{
"name": "20061102 Advisory 12/2006: phpMyAdmin - error.php XSS Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/450397/100/0/threaded"
},
{
"name": "22599",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22599"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.hardened-php.net/advisory_122006.137.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-11-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20856",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/20856"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6"
},
{
"name": "ADV-2006-4298",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/4298"
},
{
"name": "phpmyadmin-utf7-xss(29957)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29957"
},
{
"name": "20061102 Advisory 12/2006: phpMyAdmin - error.php XSS Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/450397/100/0/threaded"
},
{
"name": "22599",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22599"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.hardened-php.net/advisory_122006.137.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5718",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20856",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/20856"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6"
},
{
"name": "ADV-2006-4298",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/4298"
},
{
"name": "phpmyadmin-utf7-xss(29957)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29957"
},
{
"name": "20061102 Advisory 12/2006: phpMyAdmin - error.php XSS Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/450397/100/0/threaded"
},
{
"name": "22599",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22599"
},
{
"name": "23086",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"name": "http://www.hardened-php.net/advisory_122006.137.html",
"refsource": "MISC",
"url": "http://www.hardened-php.net/advisory_122006.137.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5718",
"datePublished": "2006-11-04T01:00:00",
"dateReserved": "2006-11-03T00:00:00",
"dateUpdated": "2024-08-07T20:04:54.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0095
Vulnerability from cvelistv5
Published
2007-01-05 18:00
Modified
2024-08-07 12:03
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html | mailing-list, x_refsource_FULLDISC | |
| http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html | mailing-list, x_refsource_FULLDISC | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 | vendor-advisory, x_refsource_MANDRIVA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31223 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/33257 | vdb-entry, x_refsource_OSVDB | |
| http://securityreason.com/securityalert/2104 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:03:37.118Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html"
},
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in \"phpMyAdmin\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "phpmyadmin-darkblueorange-path-disclosure(31223)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31223"
},
{
"name": "33257",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/33257"
},
{
"name": "2104",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2104"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in phpMyAdmin",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html"
},
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in \"phpMyAdmin\"",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html"
},
{
"name": "MDKSA-2007:199",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "phpmyadmin-darkblueorange-path-disclosure(31223)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31223"
},
{
"name": "33257",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/33257"
},
{
"name": "2104",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2104"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0095",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in phpMyAdmin",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html"
},
{
"name": "20070102 Inforamtion Discloser Vulnerabilities in \"phpMyAdmin\"",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html"
},
{
"name": "MDKSA-2007:199",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"name": "phpmyadmin-darkblueorange-path-disclosure(31223)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31223"
},
{
"name": "33257",
"refsource": "OSVDB",
"url": "http://osvdb.org/33257"
},
{
"name": "2104",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2104"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0095",
"datePublished": "2007-01-05T18:00:00",
"dateReserved": "2007-01-05T00:00:00",
"dateUpdated": "2024-08-07T12:03:37.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2001-1060
Vulnerability from cvelistv5
Published
2002-02-02 05:00
Modified
2024-08-08 04:44
Severity ?
EPSS score ?
Summary
phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/3121 | vdb-entry, x_refsource_BID | |
| http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/ | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/200596 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T04:44:07.019Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "3121",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/3121"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/"
},
{
"name": "20010731 New command execution vulnerability in myPhpAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/200596"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2001-07-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2002-02-06T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "3121",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/3121"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/"
},
{
"name": "20010731 New command execution vulnerability in myPhpAdmin",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/200596"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2001-1060",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "3121",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/3121"
},
{
"name": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/",
"refsource": "MISC",
"url": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/"
},
{
"name": "20010731 New command execution vulnerability in myPhpAdmin",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/200596"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2001-1060",
"datePublished": "2002-02-02T05:00:00",
"dateReserved": "2002-01-31T00:00:00",
"dateUpdated": "2024-08-08T04:44:07.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6618
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-41 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/95047 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.133Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-41"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "95047",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95047"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-41"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "95047",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95047"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6618",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-41",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-41"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "95047",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95047"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6618",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-3457
Vulnerability from cvelistv5
Published
2008-08-04 19:00
Modified
2024-08-07 09:37
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T09:37:27.076Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"name": "FEDORA-2008-6810",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "phpmyadmin-setup-configinc-xss(44052)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44052"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31263"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-07-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "MDVSA-2008:202",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"name": "FEDORA-2008-6810",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "32834",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "phpmyadmin-setup-configinc-xss(44052)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44052"
},
{
"name": "DSA-1641",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31263"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-3457",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "MDVSA-2008:202",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"name": "FEDORA-2008-6868",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"name": "FEDORA-2008-6810",
"refsource": "FEDORA",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"name": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf",
"refsource": "MISC",
"url": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf"
},
{
"name": "32834",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32834"
},
{
"name": "ADV-2008-2226",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"name": "phpmyadmin-setup-configinc-xss(44052)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44052"
},
{
"name": "DSA-1641",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"name": "31312",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31312"
},
{
"name": "31263",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31263"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"name": "30420",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"name": "SUSE-SR:2008:026",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-3457",
"datePublished": "2008-08-04T19:00:00",
"dateReserved": "2008-08-04T00:00:00",
"dateUpdated": "2024-08-07T09:37:27.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-2506
Vulnerability from cvelistv5
Published
2011-07-14 23:00
Modified
2024-08-06 23:00
Severity ?
EPSS score ?
Summary
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:00:34.178Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45139"
},
{
"name": "17514",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "73612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/73612"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-06-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php"
},
{
"name": "45292",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/8306"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f"
},
{
"name": "45139",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45139"
},
{
"name": "17514",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "73612",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/73612"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-2506",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt",
"refsource": "MISC",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"name": "[oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"name": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/",
"refsource": "CONFIRM",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php"
},
{
"name": "45292",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45292"
},
{
"name": "[oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"name": "[oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"name": "MDVSA-2011:124",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"name": "8306",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/8306"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f"
},
{
"name": "45139",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45139"
},
{
"name": "17514",
"refsource": "EXPLOIT-DB",
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"name": "DSA-2286",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"name": "20110707 phpMyAdmin 3.x Multiple Remote Code Executions",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"name": "73612",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/73612"
},
{
"name": "[oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"name": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html",
"refsource": "MISC",
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"name": "45315",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45315"
},
{
"name": "FEDORA-2011-9144",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-2506",
"datePublished": "2011-07-14T23:00:00",
"dateReserved": "2011-06-15T00:00:00",
"dateUpdated": "2024-08-06T23:00:34.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6631
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92496 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| https://www.phpmyadmin.net/security/PMASA-2016-54 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.029Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92496",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92496"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-54"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-17T22:06:04",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92496",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92496"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-54"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6631",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92496",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92496"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-54",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-54"
},
{
"name": "[debian-lts-announce] 20190617 [SECURITY] [DLA 1821-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6631",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4450
Vulnerability from cvelistv5
Published
2005-12-21 11:00
Modified
2024-09-16 20:07
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/18113 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:46:05.152Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "18113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18113"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-12-21T11:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "18113",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18113"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4450",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "18113",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18113"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4450",
"datePublished": "2005-12-21T11:00:00Z",
"dateReserved": "2005-12-21T00:00:00Z",
"dateUpdated": "2024-09-16T20:07:38.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5701
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:07
Severity ?
EPSS score ?
Summary
setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/91383 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-17/ | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:07:59.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f"
},
{
"name": "91383",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91383"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-17/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f"
},
{
"name": "91383",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91383"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-17/"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5701",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f"
},
{
"name": "91383",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91383"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-17/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-17/"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5701",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-16T00:00:00",
"dateUpdated": "2024-08-06T01:07:59.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4064
Vulnerability from cvelistv5
Published
2011-11-01 19:00
Modified
2024-08-06 23:53
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/50175 | vdb-entry, x_refsource_BID | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html | vendor-advisory, x_refsource_FEDORA | |
| http://secunia.com/advisories/46874 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:158 | vendor-advisory, x_refsource_MANDRIVA | |
| http://securitytracker.com/id?1026199 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:32.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php"
},
{
"name": "50175",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/50175"
},
{
"name": "FEDORA-2011-15460",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "1026199",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1026199"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php"
},
{
"name": "50175",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/50175"
},
{
"name": "FEDORA-2011-15460",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "1026199",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1026199"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4064",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php"
},
{
"name": "50175",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/50175"
},
{
"name": "FEDORA-2011-15460",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"name": "FEDORA-2011-15469",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"name": "46874",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46874"
},
{
"name": "FEDORA-2011-15472",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"name": "MDVSA-2011:158",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"name": "1026199",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1026199"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4064",
"datePublished": "2011-11-01T19:00:00",
"dateReserved": "2011-10-15T00:00:00",
"dateUpdated": "2024-08-06T23:53:32.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9855
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-63 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94527 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.660Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9855",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"name": "94527",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94527"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9855",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-1678
Vulnerability from cvelistv5
Published
2006-04-10 23:00
Modified
2024-08-07 17:19
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.debian.org/security/2006/dsa-1207 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/22781 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/24450 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25689 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/17390 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/19556 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2006/1263 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/19897 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.novell.com/linux/security/advisories/2006_04_28.html | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:19:49.442Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "24450",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/24450"
},
{
"name": "phpmyadmin-themes-xss(25689)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25689"
},
{
"name": "17390",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/17390"
},
{
"name": "19556",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19556"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1"
},
{
"name": "ADV-2006-1263",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1263"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-04-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "24450",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/24450"
},
{
"name": "phpmyadmin-themes-xss(25689)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25689"
},
{
"name": "17390",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/17390"
},
{
"name": "19556",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19556"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1"
},
{
"name": "ADV-2006-1263",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1263"
},
{
"name": "19897",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-1678",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-1207",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "22781",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22781"
},
{
"name": "24450",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/24450"
},
{
"name": "phpmyadmin-themes-xss(25689)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25689"
},
{
"name": "17390",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/17390"
},
{
"name": "19556",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19556"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1"
},
{
"name": "ADV-2006-1263",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1263"
},
{
"name": "19897",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/19897"
},
{
"name": "SUSE-SR:2006:009",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-1678",
"datePublished": "2006-04-10T23:00:00",
"dateReserved": "2006-04-10T00:00:00",
"dateUpdated": "2024-08-07T17:19:49.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4995
Vulnerability from cvelistv5
Published
2013-07-30 18:00
Modified
2024-08-06 16:59
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/61510 | vdb-entry, x_refsource_BID | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php | x_refsource_CONFIRM | |
| http://secunia.com/advisories/59832 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "61510",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/61510"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59832"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-29T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "61510",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/61510"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php"
},
{
"name": "59832",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59832"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4995",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "61510",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/61510"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php"
},
{
"name": "59832",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59832"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4995",
"datePublished": "2013-07-30T18:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:41.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9851
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-62 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO | |
| http://www.securityfocus.com/bid/94534 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.569Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-62"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94534",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94534"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-62"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94534",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94534"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9851",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-62",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-62"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "94534",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94534"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9851",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4634
Vulnerability from cvelistv5
Published
2011-12-22 20:00
Modified
2024-08-07 00:09
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:19.418Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2011-16768",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=1490533d91e9d3820e78ca4eac7981886eaea2cb"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=077c10020e349e8c1beb46309098992fde616913"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=dac8d6ce256333ff45b5f46270304b8657452740"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b289fe082441dc739939b0ba15dae0d9dc6cee92"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-12-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-01-19T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2011-16768",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=1490533d91e9d3820e78ca4eac7981886eaea2cb"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=077c10020e349e8c1beb46309098992fde616913"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php"
},
{
"name": "MDVSA-2011:198",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=dac8d6ce256333ff45b5f46270304b8657452740"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b289fe082441dc739939b0ba15dae0d9dc6cee92"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4634",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2011-16768",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=1490533d91e9d3820e78ca4eac7981886eaea2cb",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=1490533d91e9d3820e78ca4eac7981886eaea2cb"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=077c10020e349e8c1beb46309098992fde616913",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=077c10020e349e8c1beb46309098992fde616913"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php"
},
{
"name": "MDVSA-2011:198",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=dac8d6ce256333ff45b5f46270304b8657452740",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=dac8d6ce256333ff45b5f46270304b8657452740"
},
{
"name": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=b289fe082441dc739939b0ba15dae0d9dc6cee92",
"refsource": "CONFIRM",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commitdiff;h=b289fe082441dc739939b0ba15dae0d9dc6cee92"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4634",
"datePublished": "2011-12-22T20:00:00",
"dateReserved": "2011-11-29T00:00:00",
"dateUpdated": "2024-08-07T00:09:19.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-1927
Vulnerability from cvelistv5
Published
2016-02-20 01:00
Modified
2024-08-05 23:10
Severity ?
EPSS score ?
Summary
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html | vendor-advisory, x_refsource_SUSE | |
| http://www.debian.org/security/2016/dsa-3627 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html | vendor-advisory, x_refsource_SUSE | |
| https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4 | x_refsource_CONFIRM | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:10:40.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-11-25T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php"
},
{
"name": "openSUSE-SU-2016:0378",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4"
},
{
"name": "FEDORA-2016-e55278763e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-1927",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php"
},
{
"name": "openSUSE-SU-2016:0378",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "openSUSE-SU-2016:0357",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4"
},
{
"name": "FEDORA-2016-e55278763e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"name": "FEDORA-2016-e1fe01e96e",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-1927",
"datePublished": "2016-02-20T01:00:00",
"dateReserved": "2016-01-20T00:00:00",
"dateUpdated": "2024-08-05T23:10:40.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9848
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-59 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/94523 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.523Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-59"
},
{
"name": "94523",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94523"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-59"
},
{
"name": "94523",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94523"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9848",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-59",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-59"
},
{
"name": "94523",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94523"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9848",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-5116
Vulnerability from cvelistv5
Published
2006-10-02 20:00
Modified
2024-08-07 19:41
Severity ?
EPSS score ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T19:41:04.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "22126",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.hardened-php.net/advisory_072006.130.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "20061003 Concerning CSRF in phpMyAdmin 2.9.0.1 (CVE-2006-5116)",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://attrition.org/pipermail/vim/2006-October/001067.html"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-multiple-csrf(29301)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29301"
},
{
"name": "1677",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1677"
},
{
"name": "20061001 Advisory 07/2006: phpMyAdmin Multiple CSRF Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/447491/100/0/threaded"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-09-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "22126",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.hardened-php.net/advisory_072006.130.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5"
},
{
"name": "DSA-1207",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "20061003 Concerning CSRF in phpMyAdmin 2.9.0.1 (CVE-2006-5116)",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://attrition.org/pipermail/vim/2006-October/001067.html"
},
{
"name": "22781",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-multiple-csrf(29301)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29301"
},
{
"name": "1677",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1677"
},
{
"name": "20061001 Advisory 07/2006: phpMyAdmin Multiple CSRF Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/447491/100/0/threaded"
},
{
"name": "23086",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-5116",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "22126",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22126"
},
{
"name": "20253",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/20253"
},
{
"name": "http://www.hardened-php.net/advisory_072006.130.html",
"refsource": "MISC",
"url": "http://www.hardened-php.net/advisory_072006.130.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5"
},
{
"name": "DSA-1207",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"name": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download",
"refsource": "CONFIRM",
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"name": "20061003 Concerning CSRF in phpMyAdmin 2.9.0.1 (CVE-2006-5116)",
"refsource": "VIM",
"url": "http://attrition.org/pipermail/vim/2006-October/001067.html"
},
{
"name": "22781",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/22781"
},
{
"name": "phpmyadmin-multiple-csrf(29301)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29301"
},
{
"name": "1677",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1677"
},
{
"name": "20061001 Advisory 07/2006: phpMyAdmin Multiple CSRF Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/447491/100/0/threaded"
},
{
"name": "23086",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23086"
},
{
"name": "SUSE-SA:2006:071",
"refsource": "SUSE",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-5116",
"datePublished": "2006-10-02T20:00:00",
"dateReserved": "2006-10-02T00:00:00",
"dateUpdated": "2024-08-07T19:41:04.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-4079
Vulnerability from cvelistv5
Published
2005-12-08 01:00
Modified
2024-08-07 23:31
Severity ?
EPSS score ?
Summary
The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:31:48.977Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "237",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/237"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "GLSA-200512-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "15761",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15761"
},
{
"name": "17925",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17925/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"name": "17957",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17957"
},
{
"name": "20051207 Advisory 25/2005: phpMyAdmin Variables Overwrite Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/418834/100/0/threaded"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/18618"
},
{
"name": "ADV-2005-2792",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2792"
},
{
"name": "21508",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/21508"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-12-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SA:2006:004",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "237",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/237"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "GLSA-200512-03",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "15761",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15761"
},
{
"name": "17925",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17925/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"name": "17957",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17957"
},
{
"name": "20051207 Advisory 25/2005: phpMyAdmin Variables Overwrite Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/418834/100/0/threaded"
},
{
"name": "18618",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/18618"
},
{
"name": "ADV-2005-2792",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2792"
},
{
"name": "21508",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/21508"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-4079",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SA:2006:004",
"refsource": "SUSE",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"name": "237",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/237"
},
{
"name": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"name": "GLSA-200512-03",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"name": "15761",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15761"
},
{
"name": "17925",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17925/"
},
{
"name": "http://www.hardened-php.net/advisory_252005.110.html",
"refsource": "MISC",
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"name": "17957",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17957"
},
{
"name": "20051207 Advisory 25/2005: phpMyAdmin Variables Overwrite Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/418834/100/0/threaded"
},
{
"name": "18618",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/18618"
},
{
"name": "ADV-2005-2792",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2792"
},
{
"name": "21508",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/21508"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-4079",
"datePublished": "2005-12-08T01:00:00",
"dateReserved": "2005-12-08T00:00:00",
"dateUpdated": "2024-08-07T23:31:48.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-4345
Vulnerability from cvelistv5
Published
2012-08-21 23:00
Modified
2024-08-06 20:35
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php | x_refsource_CONFIRM | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2012:136 | vendor-advisory, x_refsource_MANDRIVA | |
| https://hermes.opensuse.org/messages/15513071 | vendor-advisory, x_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:35:08.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"name": "MDVSA-2012:136",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:136"
},
{
"name": "openSUSE-SU-2012:1062",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-09-07T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"name": "MDVSA-2012:136",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:136"
},
{
"name": "openSUSE-SU-2012:1062",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4345",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"name": "MDVSA-2012:136",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:136"
},
{
"name": "openSUSE-SU-2012:1062",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15513071"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4345",
"datePublished": "2012-08-21T23:00:00",
"dateReserved": "2012-08-15T00:00:00",
"dateUpdated": "2024-08-06T20:35:08.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6616
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/95042 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-39 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:28.995Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95042",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95042"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-39"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. In the \"User group\" and \"Designer\" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95042",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95042"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-39"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6616",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. In the \"User group\" and \"Designer\" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95042",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95042"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-39",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-39"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6616",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:28.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6621
Vulnerability from cvelistv5
Published
2017-01-31 19:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-44/ | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/95914 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.424Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-44/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95914",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95914"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-44/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95914",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95914"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6621",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-44/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-44/"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "95914",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95914"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6621",
"datePublished": "2017-01-31T19:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6609
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94112 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-32 | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | mailing-list, x_refsource_MLIST | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94112",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94112"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-32"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-07T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94112",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94112"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-32"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94112",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94112"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-32",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-32"
},
{
"name": "[debian-lts-announce] 20180706 [SECURITY] [DLA 1415-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6609",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-9862
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 02:59
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/94528 | vdb-entry, x_refsource_BID | |
| https://www.phpmyadmin.net/security/PMASA-2016-67 | x_refsource_CONFIRM | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:03.525Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "94528",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/94528"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-67"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-11-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "94528",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/94528"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-67"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-9862",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "94528",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/94528"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-67",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-67"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-9862",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-12-06T00:00:00",
"dateUpdated": "2024-08-06T02:59:03.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0543
Vulnerability from cvelistv5
Published
2005-02-24 05:00
Modified
2024-08-07 21:21
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/14382 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/19462 | vdb-entry, x_refsource_XF | |
| http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/12644 | vdb-entry, x_refsource_BID | |
| http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml | vendor-advisory, x_refsource_GENTOO | |
| http://marc.info/?l=bugtraq&m=110929725801154&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:21:05.505Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14382"
},
{
"name": "phpmyadmin-multiple-php-xss(19462)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19462"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "12644",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/12644"
},
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "14382",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14382"
},
{
"name": "phpmyadmin-multiple-php-xss(19462)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19462"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "12644",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/12644"
},
{
"name": "GLSA-200503-07",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0543",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "14382",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14382"
},
{
"name": "phpmyadmin-multiple-php-xss(19462)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19462"
},
{
"name": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"name": "12644",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/12644"
},
{
"name": "GLSA-200503-07",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"name": "20050224 [SECURITYREASON.COM] phpMyAdmin 2.6.1 Remote file inclusion and XSS cXIb8O3.4",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0543",
"datePublished": "2005-02-24T05:00:00",
"dateReserved": "2005-02-24T00:00:00",
"dateUpdated": "2024-08-07T21:21:05.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19970
Vulnerability from cvelistv5
Published
2018-12-11 17:00
Modified
2024-08-05 11:51
Severity ?
EPSS score ?
Summary
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2018-8/ | x_refsource_CONFIRM | |
| https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/106181 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201904-16 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:51:17.916Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "106181",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106181"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-12-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-15T22:06:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "106181",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106181"
},
{
"name": "GLSA-201904-16",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201904-16"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19970",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2018-8/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
},
{
"name": "[debian-lts-announce] 20190201 [SECURITY] [DLA 1658-1] phpmyadmin security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"name": "106181",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106181"
},
{
"name": "GLSA-201904-16",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201904-16"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19970",
"datePublished": "2018-12-11T17:00:00",
"dateReserved": "2018-12-07T00:00:00",
"dateUpdated": "2024-08-05T11:51:17.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6623
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-46 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95052 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.062Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-46"
},
{
"name": "95052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95052"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-46"
},
{
"name": "95052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95052"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6623",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-46",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-46"
},
{
"name": "95052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95052"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6623",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6617
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-40 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/95044 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-40"
},
{
"name": "95044",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95044"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-40"
},
{
"name": "95044",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95044"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6617",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-40",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-40"
},
{
"name": "95044",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95044"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6617",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3300
Vulnerability from cvelistv5
Published
2005-10-23 04:00
Modified
2024-08-07 23:10
Severity ?
EPSS score ?
Summary
The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:10:07.547Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478."
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17559"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.hardened-php.net/advisory_162005.73.html"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113017591414699\u0026w=2"
},
{
"name": "phpmyadmin-multiple-scripts-file-include(22835)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22835"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "15169",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15169"
},
{
"name": "GLSA-200510-21",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "17289",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17289/"
},
{
"name": "1015091",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1015091"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-10-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SR:2005:028",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17607"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478."
},
{
"name": "17559",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17559"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.hardened-php.net/advisory_162005.73.html"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113017591414699\u0026w=2"
},
{
"name": "phpmyadmin-multiple-scripts-file-include(22835)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22835"
},
{
"name": "DSA-880",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17337"
},
{
"name": "15169",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15169"
},
{
"name": "GLSA-200510-21",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "17289",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17289/"
},
{
"name": "1015091",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1015091"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3300",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SR:2005:028",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"name": "SUSE-SA:2005:066",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"name": "17607",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17607"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478."
},
{
"name": "17559",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17559"
},
{
"name": "http://www.hardened-php.net/advisory_162005.73.html",
"refsource": "MISC",
"url": "http://www.hardened-php.net/advisory_162005.73.html"
},
{
"name": "20051022 Advisory 16/2005: phpMyAdmin Local File Inclusion Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=113017591414699\u0026w=2"
},
{
"name": "phpmyadmin-multiple-scripts-file-include(22835)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22835"
},
{
"name": "DSA-880",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"name": "17337",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17337"
},
{
"name": "15169",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15169"
},
{
"name": "GLSA-200510-21",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"name": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"name": "17289",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17289/"
},
{
"name": "1015091",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1015091"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3300",
"datePublished": "2005-10-23T04:00:00",
"dateReserved": "2005-10-23T00:00:00",
"dateUpdated": "2024-08-07T23:10:07.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-6629
Vulnerability from cvelistv5
Published
2016-12-11 02:00
Modified
2024-08-06 01:36
Severity ?
EPSS score ?
Summary
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.phpmyadmin.net/security/PMASA-2016-52 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/92493 | vdb-entry, x_refsource_BID | |
| https://security.gentoo.org/glsa/201701-32 | vendor-advisory, x_refsource_GENTOO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:36:29.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-52"
},
{
"name": "92493",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92493"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving the $cfg[\u0027ArbitraryServerRegexp\u0027] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-52"
},
{
"name": "92493",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92493"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6629",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in phpMyAdmin involving the $cfg[\u0027ArbitraryServerRegexp\u0027] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-52",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-52"
},
{
"name": "92493",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92493"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6629",
"datePublished": "2016-12-11T02:00:00",
"dateReserved": "2016-08-06T00:00:00",
"dateUpdated": "2024-08-06T01:36:29.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-7217
Vulnerability from cvelistv5
Published
2014-10-03 01:00
Modified
2024-08-06 12:40
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html | vendor-advisory, x_refsource_SUSE | |
| http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/70252 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/61777 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961 | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:19.114Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openSUSE-SU-2014:1280",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php"
},
{
"name": "70252",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70252"
},
{
"name": "61777",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/61777"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-04-28T13:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openSUSE-SU-2014:1280",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php"
},
{
"name": "70252",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70252"
},
{
"name": "61777",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/61777"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-7217",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openSUSE-SU-2014:1280",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html"
},
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php"
},
{
"name": "70252",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70252"
},
{
"name": "61777",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/61777"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-7217",
"datePublished": "2014-10-03T01:00:00",
"dateReserved": "2014-09-28T00:00:00",
"dateUpdated": "2024-08-06T12:40:19.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-5733
Vulnerability from cvelistv5
Published
2016-07-03 01:00
Modified
2024-08-06 01:08
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:08:00.519Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91390",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/91390"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-26/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-30T16:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5"
},
{
"name": "openSUSE-SU-2016:1700",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b"
},
{
"name": "DSA-3627",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91390",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/91390"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-26/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc"
},
{
"name": "GLSA-201701-32",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-5733",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5"
},
{
"name": "openSUSE-SU-2016:1700",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b"
},
{
"name": "DSA-3627",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"name": "91390",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/91390"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a"
},
{
"name": "https://www.phpmyadmin.net/security/PMASA-2016-26/",
"refsource": "CONFIRM",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-26/"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc"
},
{
"name": "GLSA-201701-32",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"name": "openSUSE-SU-2016:1699",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-5733",
"datePublished": "2016-07-03T01:00:00",
"dateReserved": "2016-06-21T00:00:00",
"dateUpdated": "2024-08-06T01:08:00.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-5368
Vulnerability from cvelistv5
Published
2012-10-25 10:00
Modified
2024-08-06 21:05
Severity ?
EPSS score ?
Summary
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php | x_refsource_CONFIRM | |
| https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0 | x_refsource_CONFIRM | |
| http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html | vendor-advisory, x_refsource_SUSE | |
| http://www.securityfocus.com/bid/55939 | vdb-entry, x_refsource_BID | |
| https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:46.971Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0"
},
{
"name": "openSUSE-SU-2012:1507",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"name": "55939",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55939"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-10-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-12-05T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0"
},
{
"name": "openSUSE-SU-2012:1507",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"name": "55939",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55939"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5368",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php",
"refsource": "CONFIRM",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0"
},
{
"name": "openSUSE-SU-2012:1507",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"name": "55939",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55939"
},
{
"name": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a",
"refsource": "CONFIRM",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5368",
"datePublished": "2012-10-25T10:00:00",
"dateReserved": "2012-10-10T00:00:00",
"dateUpdated": "2024-08-06T21:05:46.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2011-02-14 22:00
Modified
2024-11-21 01:25
Severity ?
Summary
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3E4A873D-985F-48CD-A22E-2ACFEAE92DE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "38E30FF6-D50D-4E5D-9C09-EA1618BA157D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file."
},
{
"lang": "es",
"value": "PhpMyAdmin v2.11.x antes de v2.11.11.2, y v3.3.x antes de v3.3.9.1, no controla correctamente la ausencia de los ficheros (1) README, (2) Changelog , y (3) Los archivos de licencia, que permite a atacantes remotos obtener la ruta de instalaci\u00f3n a trav\u00e9s de una petici\u00f3n directa de un archivo inexistente."
}
],
"id": "CVE-2011-0986",
"lastModified": "2024-11-21T01:25:14.890",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-02-14T22:00:00.977",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43478"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65424"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-12-08 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 | |
| phpmyadmin | phpmyadmin | 4.2.4 | |
| phpmyadmin | phpmyadmin | 4.2.5 | |
| phpmyadmin | phpmyadmin | 4.2.6 | |
| phpmyadmin | phpmyadmin | 4.2.7 | |
| phpmyadmin | phpmyadmin | 4.2.7.1 | |
| phpmyadmin | phpmyadmin | 4.2.8 | |
| phpmyadmin | phpmyadmin | 4.2.8.1 | |
| phpmyadmin | phpmyadmin | 4.2.9 | |
| phpmyadmin | phpmyadmin | 4.2.9.1 | |
| phpmyadmin | phpmyadmin | 4.2.10 | |
| phpmyadmin | phpmyadmin | 4.2.10.1 | |
| phpmyadmin | phpmyadmin | 4.2.11 | |
| phpmyadmin | phpmyadmin | 4.2.12 | |
| phpmyadmin | phpmyadmin | 4.2.13 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "B6360AD1-B295-4123-A6AC-99B13FA12C1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "29255C68-9B71-45DF-95B0-C84762B8CDD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la caracteristica de redirecci\u00f3n en url.php en phpMyAdmin 4.2.x anterior a 4.2.13.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro url."
}
],
"id": "CVE-2014-9219",
"lastModified": "2024-11-21T02:20:25.270",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-12-08T11:59:13.233",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99137"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99137"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-16 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.1 | |
| phpmyadmin | phpmyadmin | 2.8.0.2 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031."
}
],
"evaluatorSolution": "Update to version 2.8.0.4.\r\nhttp://www.phpmyadmin.net/home_page/downloads.php",
"id": "CVE-2006-2417",
"lastModified": "2024-11-21T00:11:16.373",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-16T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20113"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26444"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26444"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-16 11:02
Modified
2024-11-21 00:02
Severity ?
Summary
CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.2.0 | |
| phpmyadmin | phpmyadmin | 2.2.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.1_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.3_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de CRLF en phpMyAdmin anteriores a 2.6.4-pl4 permite a atacantes remotos conducir ataques de separaci\u00f3n de respuesta HTTP mediante scripts no especificados.\r\n"
}
],
"id": "CVE-2005-3621",
"lastModified": "2024-11-21T00:02:16.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-16T11:02:00.000",
"references": [
{
"source": "security@debian.org",
"url": "http://secunia.com/advisories/17578"
},
{
"source": "security@debian.org",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "security@debian.org",
"url": "http://securitytracker.com/id?1015213"
},
{
"source": "security@debian.org",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "security@debian.org",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17578"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-19 23:55
Modified
2024-11-21 01:56
Severity ?
Summary
phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | opensuse | 12.2 | |
| opensuse | opensuse | 12.3 | |
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 3.5.8.2 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 | |
| phpmyadmin | phpmyadmin | 4.0.4.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D806A17E-B8F9-466D-807D-3F1E77603DC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F18C84-9F4D-4AE3-8953-638241800D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php."
},
{
"lang": "es",
"value": "phpMyAdmin 3.5.x y 4.0.x anterior a 4.0.5, permite a atacantes remotos evitar la protecci\u00f3n frente al clickjacking a trav\u00e9s de determinados vectores relacionados con Header.class.php."
}
],
"id": "CVE-2013-5029",
"lastModified": "2024-11-21T01:56:56.070",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-19T23:55:09.133",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54488"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54488"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-10.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/240b8332db53dedc27baeec5306dabad3bdece3b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/24d0eb55203b029f250c77d63f2900ffbe099e8b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/66fe475d4f51b1761719cb0cab360748800373f7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/da4042fb6c4365dc8187765c3bf525043687c66f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin donde, bajo ciertas condiciones, phpMyAdmin no puede eliminar archivos temporales durante la importaci\u00f3n de archivos ESRI. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6632",
"lastModified": "2024-11-21T02:56:31.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:41.863",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92497"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-55"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92497"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-55"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-03-01 11:59
Modified
2024-11-21 02:48
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F90283AD-A616-403C-BE69-BCB2FD58A2CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "043B846F-4CDF-402A-B14A-B4949B1D403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C7B52D3D-C5F0-4793-AFA3-C518400DB71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476503-1A1B-408B-9E66-1E4940090AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7123D6E6-3AE7-4413-AD6E-0D68D44C6F94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05A2EBE2-E55C-45DF-A74C-1B5F7E6EEC25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "909DFCAB-A44B-4EB8-B54D-066699AE760B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.15, 4.4.x en versiones anteriores a 4.4.15.5 y 4.5.x en versiones anteriores a 4.5.5.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) una cabecera Host HTTP manipulada, relacionada con libraries/Config.class.php; (2) datos JSON manipulados, relacionados con file_echo.php; (3) una petici\u00f3n SQL manipulada, relacionada con js/functions.js; (4) el par\u00e1metro inicial en libraries/server_privileges.lib.php en la p\u00e1gina de cuentas de usuario; o (5) el par\u00e1metro it en libraries/controllers/TableSearchController.class.php en la p\u00e1gina zoom search."
}
],
"id": "CVE-2016-2560",
"lastModified": "2024-11-21T02:48:41.913",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-03-01T11:59:02.237",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-11/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-11/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-11 11:28
Modified
2024-11-21 00:25
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C62B955C-12BF-4118-831C-EEBC807E940B",
"versionEndIncluding": "2.9.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin versiones anteriores a 2.9.2-rc1 permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante vectores no especificados.\r\nNOTA: algunos de estos detalles se han obtenido de informaci\u00f3n de terceros."
}
],
"id": "CVE-2007-0204",
"lastModified": "2024-11-21T00:25:14.747",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-11T11:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32667"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23702"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23702"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31387"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-08-22 01:55
Modified
2024-11-21 02:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.1.0 | |
| phpmyadmin | phpmyadmin | 4.1.1 | |
| phpmyadmin | phpmyadmin | 4.1.2 | |
| phpmyadmin | phpmyadmin | 4.1.3 | |
| phpmyadmin | phpmyadmin | 4.1.4 | |
| phpmyadmin | phpmyadmin | 4.1.5 | |
| phpmyadmin | phpmyadmin | 4.1.6 | |
| phpmyadmin | phpmyadmin | 4.1.7 | |
| phpmyadmin | phpmyadmin | 4.1.8 | |
| phpmyadmin | phpmyadmin | 4.1.9 | |
| phpmyadmin | phpmyadmin | 4.1.10 | |
| phpmyadmin | phpmyadmin | 4.1.11 | |
| phpmyadmin | phpmyadmin | 4.1.12 | |
| phpmyadmin | phpmyadmin | 4.1.13 | |
| phpmyadmin | phpmyadmin | 4.1.14 | |
| phpmyadmin | phpmyadmin | 4.1.14.1 | |
| phpmyadmin | phpmyadmin | 4.1.14.2 | |
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 | |
| phpmyadmin | phpmyadmin | 4.2.4 | |
| phpmyadmin | phpmyadmin | 4.2.5 | |
| phpmyadmin | phpmyadmin | 4.2.6 | |
| phpmyadmin | phpmyadmin | 4.2.7 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la p\u00e1gina de visualizaci\u00f3n de operaciones en phpMyAdmin 4.1.x anterior a 4.1.14.3 y 4.2.x anterior a 4.2.7.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de visualizaci\u00f3n manipulado, relacionado con js/functions.js."
}
],
"id": "CVE-2014-5274",
"lastModified": "2024-11-21T02:11:46.020",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-08-22T01:55:08.777",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0cd293f5e13aa245e4a57b8d373597cc0e421b6f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-02-14 22:00
Modified
2024-11-21 01:25
Severity ?
Summary
The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3E4A873D-985F-48CD-A22E-2ACFEAE92DE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "38E30FF6-D50D-4E5D-9C09-EA1618BA157D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "83EDDB91-C86F-4500-8C20-9CD7909EC5FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user\u0027s execution of a SQL query by creating a bookmark."
},
{
"lang": "es",
"value": "La funci\u00f3n PMA_Bookmark_get en libraries/bookmark.lib.php de phpMyAdmin v2.11.x y anteriores a v2.11.11.3, y v3.3.x anteriores a v3.3.9.2,no restringe adecuadamente las consultas de bookmark, lo que hace m\u00e1s f\u00e1cil para los usuarios remotos autenticados activar la ejecuci\u00f3n de una consulta SQL de otro usuario mediante la creaci\u00f3n de un marcador."
}
],
"id": "CVE-2011-0987",
"lastModified": "2024-11-21T01:25:15.050",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-02-14T22:00:06.680",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43324"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43391"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/43478"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2167"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/46359"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0381"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0409"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0512"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0570"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43324"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/43478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2167"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:026"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/46359"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0385"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0409"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0570"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65390"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-02-13 06:15
Modified
2024-11-21 07:50
Severity ?
Summary
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2023-1/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2023-1/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "00C4BB99-DA85-4281-BB94-2AC20FF80DA8",
"versionEndExcluding": "4.9.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BCD4C26A-0823-4EAA-8052-6D6A269308E4",
"versionEndExcluding": "5.2.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface."
}
],
"id": "CVE-2023-25727",
"lastModified": "2024-11-21T07:50:01.577",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-13T06:15:11.083",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2023-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2023-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-07-01 13:00
Modified
2024-11-21 01:04
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CBEB6E81-2E97-45FF-9764-C50820F33B92",
"versionEndIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F14B08F-6583-4686-B534-616D42B7D90B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "D4CD5425-79A4-4506-8BDA-299449EB51DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F754BBA9-765F-4BDE-9AF3-3DA4300B17C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "7A136E97-05EA-4ADF-82F5-E2D0C7737D6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "53AE58C1-CB8C-415F-BF58-BD356D3AC000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "704C4359-A80E-456F-AA69-D188E4DFDBA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5DAB33AF-D8A9-444F-AC69-FACCFA0EEB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "33423F75-0F5A-49F6-BF70-66DC2CE39E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0611660F-F060-453C-8BE2-1599FE3FF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD9FD0D-2786-43BB-938B-A45D9B60E08E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3CE1C3-59FF-457F-8579-996CA60CF6AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F2B3C2-0EDB-48D3-92BC-B1CA0E41F230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B64201-5B5B-4D22-B341-C601DC54BFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3130CFD-FF94-48D2-BF9A-D7FDD3CD6A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "5899F407-1D31-452A-954C-966895ED7D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFDEFBE-E512-4B0C-BBEC-8FCA29228DDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D6583C3A-EB4E-4F8C-ADFD-1B19E879414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1-rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "6DFB2783-EB5A-42AD-97FC-1BB226527BEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "CFAD5F7D-AA93-46B7-996B-B0761143B334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1:*:*:*:*:*:*",
"matchCriteriaId": "F0BD3CDF-31C5-4B8A-8314-A5F0F9D28AA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3-rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "78CCE83F-6B8F-4ADA-8E11-8C93BB10C66F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4-rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "310C264A-5657-450F-979E-6EE2B83B5900",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5-rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "B0ABF8B6-91C3-466E-B974-E1D7400E1ABB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "1DD4EF8B-EA44-46F2-9C28-1D9D1D8BA2CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "665E32EA-D728-43E4-B646-DAE408A1ECF3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin anterior a v3.2.0.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un favorito con una sentencia SQL manipulada."
}
],
"id": "CVE-2009-2284",
"lastModified": "2024-11-21T01:04:31.093",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-07-01T13:00:01.733",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35649"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35715"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:192"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35649"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35715"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:192"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://secunia.com/advisories/14382 | Patch, Vendor Advisory | |
| cve@mitre.org | http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 | Vendor Advisory | |
| cve@mitre.org | http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/14382 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://sourceforge.net/tracker/index.php?func=detail&aid=1149383&group_id=23067&atid=377408 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.1 allows remote attackers to obtain the full path of the server via direct requests to (1) sqlvalidator.lib.php, (2) sqlparser.lib.php, (3) select_theme.lib.php, (4) select_lang.lib.php, (5) relation_cleanup.lib.php, (6) header_meta_style.inc.php, (7) get_foreign.lib.php, (8) display_tbl_links.lib.php, (9) display_export.lib.php, (10) db_table_exists.lib.php, (11) charset_conversion.lib.php, (12) ufpdf.php, (13) mysqli.dbi.lib.php, (14) setup.php, or (15) cookie.auth.lib.php, which reveals the path in a PHP error message."
}
],
"id": "CVE-2005-0544",
"lastModified": "2024-11-20T23:55:22.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | leap | 42.1 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 | |
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query."
},
{
"lang": "es",
"value": "Vulnerbilidad de inyecci\u00f3n SQL en libraries/central_columns.lib.php en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x before 4.6.3 permite a atacantes remotos ejecutar comando SQL arbitrarios a trav\u00e9s de un nombre de database manipulado que es manejado incorrectamente en una consulta de la columna central."
}
],
"id": "CVE-2016-5703",
"lastModified": "2024-11-21T02:54:51.397",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:14.610",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91381"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-19/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ef6c66dca1b0cb0a1a482477938cfc859d2baee3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-19/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-03-01 05:00
Modified
2024-11-20 23:49
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.5.0 | |
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.7 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl2 | |
| gentoo | linux | 1.4 | |
| gentoo | linux | 1.4 | |
| gentoo | linux | 1.4 | |
| gentoo | linux | 1.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "65ED9D8C-604D-4B0B-A192-C0DA4D2E9AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D1FD0EB4-E744-4465-AFEE-A3C807C9C993",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1D866A7D-F0B9-4EA3-93C6-1E7C2C2A861F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc3:*:*:*:*:*:*",
"matchCriteriaId": "57772E3B-893C-408A-AA3B-78C972ED4D5E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser."
}
],
"id": "CVE-2004-1055",
"lastModified": "2024-11-20T23:49:59.147",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-03-01T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.netvigilance.com/html/advisory0005.htm"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.netvigilance.com/html/advisory0005.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18158"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-06-25 11:19
Modified
2024-11-21 02:10
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.2.x anterior a 4.2.4 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre manipulado de (1) base de datos o (2) de tabla que no se maneja debidamente despu\u00e9s de su presencia en (a) la lista de favoritos o (b) tablas recientes."
}
],
"id": "CVE-2014-4348",
"lastModified": "2024-11-21T02:10:01.053",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-06-25T11:19:22.497",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68201"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68201"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7c703c03f656debcea2a16468bd53660fc888e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d18a2dd9faad7e0e96df799b59e16ef587afb838"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con una petici\u00f3n muy grande para la funci\u00f3n de particionamiento de tabla, es posible invocar un ataque de denegaci\u00f3n de servicio (DoS). Todas las versiones 4.6.x (anteriores a 4.6.5) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9863",
"lastModified": "2024-11-21T03:01:54.677",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:04.917",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94526"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-68"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94526"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-68"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-03-31 22:44
Modified
2024-11-21 00:44
Severity ?
Summary
phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 4.0 | |
| fedoraproject | fedora | 7 | |
| fedoraproject | fedora | 8 | |
| opensuse | opensuse | 10.2 | |
| opensuse | opensuse | 10.3 | |
| opensuse | opensuse | 11.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "978C2DD8-2223-42D1-A777-23B74C52C86B",
"versionEndExcluding": "2.11.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F92AB32-E7DE-43F4-B877-1F41FA162EC7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*",
"matchCriteriaId": "E3EFD171-01F7-450B-B6F3-0F7E443A2337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*",
"matchCriteriaId": "72E4DB7F-07C3-46BB-AAA2-05CD0312C57F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "24818450-FDA1-429A-AC17-68F44F584217",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C35B68DF-1440-4587-8458-9C5F4D1E43F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B42AB65-443B-4655-BAEA-4EB4A43D9509",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information."
},
{
"lang": "es",
"value": "phpMyAdmin versiones anteriores a 2.11.5.1, almacena la clave secreta MySQL de (1) nombre de usuario (2) contrase\u00f1a, y (3) Blowfish, en texto sin cifrar en un archivo de Sesi\u00f3n bajo /tmp, que permite a los usuarios locales obtener informaci\u00f3n confidencial."
}
],
"id": "CVE-2008-1567",
"lastModified": "2024-11-21T00:44:49.617",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2008-03-31T22:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29588"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29613"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/28560"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/1037/references"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41541"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29588"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1909711\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Patch",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/28560"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/1037/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41541"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00031.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00080.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-312"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-21 11:03
Modified
2024-11-21 00:04
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://secunia.com/advisories/18113 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/18113 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0_pl1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed."
}
],
"id": "CVE-2005-4450",
"lastModified": "2024-11-21T00:04:17.387",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-21T11:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18113"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the "Tracking" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the \"Tracking\" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
},
{
"lang": "es",
"value": "Se descubrieron problemas de XSS en phpMyAdmin. Esto afecta al panel de navegaci\u00f3n y a la funci\u00f3n de ocultaci\u00f3n de base de datos/tabla (un nombre de base de datos especialmente manipulado se puede utilizar para desencadenar un ataque XSS); la funcionalidad \"Tracking\" (una consulta especialmente manipulada se puede utilizar para desencadenar un ataque XSS); y la funcionalidad de visualizaci\u00f3n GIS. Todas las versiones 4.6.x (anteriores a 4.6.4) y versiones 4.4.x (anteriores a 4.4.15.8) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6615",
"lastModified": "2024-11-21T02:56:27.217",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:22.003",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95041"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-38"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95041"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-38"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/95721 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-3 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95721 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-3 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.18:*:*:*:*:*:*:*",
"matchCriteriaId": "B90D111A-A076-4936-BA7F-E2C3ACE44B8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.9:*:*:*:*:*:*:*",
"matchCriteriaId": "09D97993-070A-4D32-B560-38AF28C87A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "33130418-95AC-41D2-B8B0-A107C9CABCFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality"
},
{
"lang": "es",
"value": "phpMyAdmin en las versiones 4,0, 4,4, y 4,6 es vulnerable a una debilidad de denegaci\u00f3n de servicio (DOS) en la funcionalidad de table editing."
}
],
"id": "CVE-2017-1000014",
"lastModified": "2024-11-21T03:03:58.267",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.360",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95721"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95721"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-3"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-10-28 10:59
Modified
2024-11-21 02:37
Severity ?
Summary
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter."
},
{
"lang": "es",
"value": "La funcionalidad de redireccionado en url.php en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.1 y 4.5.x en versiones anteriores a 4.5.1 permite a atacantes remotos suplantar contenido a trav\u00e9s de un par\u00e1metro url."
}
],
"id": "CVE-2015-7873",
"lastModified": "2024-11-21T02:37:34.600",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-10-28T10:59:19.110",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/77299"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1034013"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171326.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169987.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/77299"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1034013"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd097656758f981f80fb9029c7d6b4294582b706"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-22 05:15
Modified
2024-11-21 04:56
Severity ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| suse | package_hub | - | |
| suse | linux_enterprise | 12.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "481F6868-9D3C-4AF8-BDF6-43A7551537A1",
"versionEndExcluding": "4.9.5",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C68997D3-1D7B-47C7-8092-0A3412C21353",
"versionEndExcluding": "5.0.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "284A8DA0-317B-4BBE-AECB-7E91BBF0DD3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table."
},
{
"lang": "es",
"value": "En phpMyAdmin versiones 4.x anteriores a 4.9.5 y versiones 5.x anteriores a 5.0.2, se ha detectado una vulnerabilidad de inyecci\u00f3n SQL donde determinados par\u00e1metros no se escapan apropiadamente al generar determinadas consultas para acciones de b\u00fasqueda en la biblioteca libraries/classes/Controllers/Table/TableSearchController.php. Un atacante puede generar un nombre de base de datos o tabla dise\u00f1ados. El ataque puede ser realizado si un usuario intenta determinadas operaciones de b\u00fasqueda sobre la base de datos o tabla maliciosa."
}
],
"id": "CVE-2020-10802",
"lastModified": "2024-11-21T04:56:06.057",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-22T05:15:11.603",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-3/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name."
}
],
"id": "CVE-2004-2631",
"lastModified": "2024-11-20T23:53:50.907",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11974"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1010614"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7314"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securiteam.com/unixfocus/5QP040ADFW.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16542"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1010614"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securiteam.com/unixfocus/5QP040ADFW.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16542"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-11 11:28
Modified
2024-11-21 00:25
Severity ?
Summary
Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C62B955C-12BF-4118-831C-EEBC807E940B",
"versionEndIncluding": "2.9.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades no especificadas en phpMyAdmin versiones anteriores a 2.9.2-rc1 tienen un impacto desconocido y vectores de ataque."
}
],
"id": "CVE-2007-0203",
"lastModified": "2024-11-21T00:25:14.597",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-11T11:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32666"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23702"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0125"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32666"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23702"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/21987"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0125"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-12-26 02:59
Modified
2024-11-21 01:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades XSS en la funci\u00f3n PMA_unInlineEditRow en js/sql.js en phpMyAdmin 3.4.x anterior a 3.4.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a trav\u00e9s de (1) el nombre de la base de datos, (2) el nombre de la tabla o (3) el nombre de la columna por un tratamiento indebido despu\u00e9s de la operaci\u00f3n de edici\u00f3n de l\u00edneas."
}
],
"id": "CVE-2011-3592",
"lastModified": "2024-11-21T01:30:48.710",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-12-26T02:59:06.003",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-12-02 16:22
Modified
2024-11-21 01:20
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.11:*:*:*:*:*:*:*",
"matchCriteriaId": "3E4A873D-985F-48CD-A22E-2ACFEAE92DE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la funcion PMA_linkOrButton en libraries/common.lib.php en el script de b\u00fasqueda database (db) en phpMyAdmin v2.11.x anterior a v2.11.11.1 y v3.x anterior a v3.3.8.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de una solicitud manipulada."
}
],
"id": "CVE-2010-4329",
"lastModified": "2024-11-21T01:20:41.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-12-02T16:22:21.630",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42408"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/42477"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/42725"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:244"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/69516"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45100"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3082"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/3087"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/3158"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/42477"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/42725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:244"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/69516"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45100"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/3087"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/3158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2011/0001"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fedoraproject | fedora | 22 | |
| fedoraproject | fedora | 23 | |
| opensuse | leap | 42.1 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la funci\u00f3n goToFinish1NF en js/normalization.js en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de tabla en la p\u00e1gina de normalizaci\u00f3n."
}
],
"id": "CVE-2016-2043",
"lastModified": "2024-11-21T02:47:40.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:06.453",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/019c4f25d500ec5db9ba3b84cc961a7e4e850738"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-11-04 01:07
Modified
2024-11-21 00:20
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.4_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl4 | |
| phpmyadmin | phpmyadmin | 2.6.4_rc1 | |
| phpmyadmin | phpmyadmin | 2.7 | |
| phpmyadmin | phpmyadmin | 2.7.0_beta1 | |
| phpmyadmin | phpmyadmin | 2.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.8.1 | |
| phpmyadmin | phpmyadmin | 2.8.2 | |
| phpmyadmin | phpmyadmin | 2.8.3 | |
| phpmyadmin | phpmyadmin | 2.8.4 | |
| phpmyadmin | phpmyadmin | 2.9 | |
| phpmyadmin | phpmyadmin | 2.9.1 | |
| phpmyadmin | phpmyadmin | 2.9.2 | |
| phpmyadmin | phpmyadmin | 2.9_rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0611660F-F060-453C-8BE2-1599FE3FF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3CE1C3-59FF-457F-8579-996CA60CF6AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B64201-5B5B-4D22-B341-C601DC54BFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3130CFD-FF94-48D2-BF9A-D7FDD3CD6A97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos (XSS) en error.php en phpMyAdmin 2.6.4 hasta la 2.9.0.2 permite a un atacante remoto inyectar secuencias de comandos web o HTML a trav\u00e9s de codificaciones de caracteres UTF-7 or US-ASCII, lo cual son inyectados dentro de un mensaje de error, como se demostr\u00f3 por una respuesta con un el par\u00e1metro utf7 acompa\u00f1ado por datos UTF-7."
}
],
"id": "CVE-2006-5718",
"lastModified": "2024-11-21T00:20:16.247",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-11-04T01:07:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22599"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_122006.137.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/450397/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20856"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/4298"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22599"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_122006.137.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/450397/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/4298"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29957"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-19 02:28
Modified
2024-11-21 00:24
Severity ?
Summary
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://marc.info/?l=bugtraq&m=116370414309444&w=2 | Third Party Advisory | |
| cve@mitre.org | http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8 | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/21137 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=116370414309444&w=2 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/21137 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 2.9.0 | |
| phpmyadmin | phpmyadmin | 2.9.0.1 | |
| phpmyadmin | phpmyadmin | 2.9.0.2 | |
| phpmyadmin | phpmyadmin | 2.9.0.3 | |
| phpmyadmin | phpmyadmin | 2.9.0_beta1 | |
| phpmyadmin | phpmyadmin | 2.9.0_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5DE07071-A27E-4BC0-937C-32415A6A6C03",
"versionEndIncluding": "2.9.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php."
},
{
"lang": "es",
"value": "PhpMyAdmin en versiones anteriores a 2.9.1.1 permite a atacantes remotos obtener la ruta completa del servidor a trav\u00e9s de peticiones directas a (a) scripts/check_lang.php y (b) themes/darkblue_orange/layout.inc.php; y a trav\u00e9s de los argumentos de array (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[] y (6) tbl_group[] en (c) index.php y el argumento (7) back[] en(d) sql.php; y un par\u00e1metro no v\u00e1lido (8) sort_by en (e) server_databases.php y (9) el par\u00e1metro db en (f) db_printview.php."
}
],
"id": "CVE-2006-6943",
"lastModified": "2024-11-21T00:24:00.900",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-19T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21137"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21137"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94524 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-58 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94524 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-58 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user\u0027s blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Cuando el usuario no especifica una clave blowfish_secret para cifrar las cookies, phpMyAdmin genera una en tiempo de ejecuci\u00f3n. Se inform\u00f3 de una vulnerabilidad donde la forma en que se crea este valor utiliza un algoritmo d\u00e9bil. Esto podr\u00eda permitir a un atacante determinar los usuarios blowfish_secret y potencialmente descifrar sus cookies. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9847",
"lastModified": "2024-11-21T03:01:52.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:44.553",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94524"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-58"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94524"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-58"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-03-26 14:30
Modified
2024-11-21 01:01
Severity ?
Summary
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 3.1.0 | |
| phpmyadmin | phpmyadmin | 3.1.0.0 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B142F14-A80C-4B95-86C9-0B57436AE8FA",
"versionEndIncluding": "3.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n CRLF en el archivo bs_disp_as_mime_type.php en la caracter\u00edstica BLOB streaming en phpMyAdmin anteriores a v3.1.3.1 permite a los atacantes remotos inyectar arbitrariamente cabeceras HTTP y llevar a cabo ataques de separaci\u00f3n de respuesta HTTP a trav\u00e9s de los par\u00e1metros (1) c_type y posiblemente (2) file_type"
}
],
"id": "CVE-2009-1149",
"lastModified": "2024-11-21T01:01:46.947",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-03-26T14:30:00.217",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34468"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34642"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34468"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php."
},
{
"lang": "es",
"value": "La implementaci\u00f3n de Transformation en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 no usa el mecanismo de protecci\u00f3n no-referrer Content Security Policy (CSP), lo que facilita a atacantes remotos llevar a cabo ataques CSRF leyendo un token autenticado en una cabecera Referer, relacionado con libraries/Header.php."
}
],
"id": "CVE-2016-5739",
"lastModified": "2024-11-21T02:54:55.820",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:25.970",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91389"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-28/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1e5716cb96d46efc305381ae0da08e73fe340f05"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2f4950828ec241e8cbdcf13090c2582a6fa620cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-28/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-02-21 15:29
Modified
2024-11-21 04:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/103099 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 | Patch, Vendor Advisory | |
| cve@mitre.org | https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/ | Exploit, Patch, Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-1/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103099 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/ | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-1/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E8500C8A-57CA-4EF3-8638-7298EBA2572B",
"versionEndExcluding": "4.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL."
},
{
"lang": "es",
"value": "Una vulnerabilidad Cross-Site Scripting (XSS) en db_central_columns.php en phpMyAdmin, en versiones anteriores a la 4.7.8, permite que atacantes remotos autenticados inyecten scripts web o HTLM arbitrarios mediante una URL manipulada."
}
],
"id": "CVE-2018-7260",
"lastModified": "2024-11-21T04:11:53.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-02-21T15:29:00.680",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103099"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103099"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-19 02:28
Modified
2024-11-21 00:24
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 2.9.0 | |
| phpmyadmin | phpmyadmin | 2.9.0.1 | |
| phpmyadmin | phpmyadmin | 2.9.0.2 | |
| phpmyadmin | phpmyadmin | 2.9.0.3 | |
| phpmyadmin | phpmyadmin | 2.9.0_beta1 | |
| phpmyadmin | phpmyadmin | 2.9.0_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc2 | |
| debian | debian_linux | 3.1 | |
| debian | debian_linux | 4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5DE07071-A27E-4BC0-937C-32415A6A6C03",
"versionEndIncluding": "2.9.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A2E0C1F8-31F5-4F61-9DF7-E49B43D3C873",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F92AB32-E7DE-43F4-B877-1F41FA162EC7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en PhpMyAdmin versiones anteriores a 2.9.1.1 permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante (1) un comentario en un nombre de talba, tal y como se explota a trav\u00e9s de (a) db_operations.php, (2) el par\u00e1metro db en (b) db_create.php, (3) el par\u00e1metro newname en db_operations.php, el par\u00e1metro(4) query_history_latest, (5) query_history_latest_db, y (6) querydisplay_tab en (c) querywindow.php, y (7) el par\u00e1metro pos en(d) sql.php."
}
],
"id": "CVE-2006-6942",
"lastModified": "2024-11-21T00:24:00.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-19T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "http://secunia.com/advisories/26733"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21137"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=116370414309444\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "http://secunia.com/advisories/26733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/21137"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable"
],
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30310"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-25 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.10.1.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin versiones anteriores a 2.10.1.0 permiten a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n mediante (1) el par\u00e1metro fieldkey en browse_foreigners.php \u00f3 (2) entradas concretas en la funci\u00f3n PMA_sanitize."
}
],
"id": "CVE-2007-2245",
"lastModified": "2024-11-21T00:30:17.417",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-04-25T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35050"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24952"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/ChangeLog.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1508"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33898"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24952"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/ChangeLog.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1508"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33898"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-22 04:15
Modified
2024-11-21 04:56
Severity ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| suse | package_hub | - | |
| suse | linux_enterprise | 12.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "481F6868-9D3C-4AF8-BDF6-43A7551537A1",
"versionEndExcluding": "4.9.5",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C68997D3-1D7B-47C7-8092-0A3412C21353",
"versionEndExcluding": "5.0.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "284A8DA0-317B-4BBE-AECB-7E91BBF0DD3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in libraries/classes/Server/Privileges.php and libraries/classes/UserPassword.php). A malicious user with access to the server could create a crafted username, and then trick the victim into performing specific actions with that user account (such as editing its privileges)."
},
{
"lang": "es",
"value": "En phpMyAdmin versiones 4.x anteriores a 4.9.5 y versiones 5.x anteriores a 5.0.2, se encontr\u00f3 una vulnerabilidad de inyecci\u00f3n SQL en la recuperaci\u00f3n del nombre de usuario actual (en las bibliotecas libraries/classes/Server/Privileges.php y libraries/classes/UserPassword.php). Un usuario malicioso con acceso al servidor podr\u00eda crear un nombre de usuario dise\u00f1ado y luego enga\u00f1ar a la v\u00edctima para que realice acciones espec\u00edficas con esa cuenta de usuario (tal y como editar sus privilegios)."
}
],
"id": "CVE-2020-10804",
"lastModified": "2024-11-21T04:56:06.423",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-22T04:15:11.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario no autenticado es capaz de ejecutar un ataque de denegaci\u00f3n de servicio (DoS) forzando las conexiones persistentes cuando phpMyAdmin se est\u00e1 ejecutando con cfg[\u0027AllowArbitraryServer\u0027]=true. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6622",
"lastModified": "2024-11-21T02:56:29.463",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:29.690",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95049"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-45"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-45"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-06-05 05:29
Modified
2024-11-21 04:23
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C2100725-BD18-4599-9B19-5B8746A4E1DF",
"versionEndExcluding": "4.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken \u003cimg\u003e tag pointing at the victim\u0027s phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim."
},
{
"lang": "es",
"value": "Un problema fue descubierto en phpMyAdmin antes del 4.9.0. Fue descubierta una vulnerabilidad que permite a un atacante desencadenar un ataque CSRF contra un usuario de phpMyAdmin. El atacante puede enga\u00f1ar al usuario, por ejemplo, a trav\u00e9s de una etiqueta rota que apunta a la base de datos phpMyAdmin de la v\u00edctima, y el atacante puede entregar una carga \u00fatil (como una declaraci\u00f3n INSERT o DELETE) a la v\u00edctima."
}
],
"id": "CVE-2019-12616",
"lastModified": "2024-11-21T04:23:11.647",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-06-05T05:29:00.510",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/108619"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/108619"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-4/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-09 22:15
Modified
2024-11-21 05:34
Severity ?
Summary
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html | Exploit, Third Party Advisory | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2020-1/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2020-1/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| suse | suse_linux_enterprise_server | 12 | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A0C08FCF-E9D9-4889-A7B3-E44D990B09C9",
"versionEndExcluding": "4.9.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "98CE1E76-7BF6-4CE0-BF18-DCA1116CCB15",
"versionEndExcluding": "5.0.1",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*",
"matchCriteriaId": "9C649194-B8C2-49F7-A819-C635EE584ABF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server."
},
{
"lang": "es",
"value": "En phpMyAdmin versiones 4 anteriores a 4.9.4 y versiones 5 anteriores a 5.0.1, una inyecci\u00f3n SQL se presenta en la p\u00e1gina de cuentas de usuario. Un usuario malicioso podr\u00eda inyectar SQL personalizado en lugar de su propio nombre de usuario cuando crea consultas en esta p\u00e1gina. Un atacante necesita tener una cuenta MySQL v\u00e1lida para acceder al servidor."
}
],
"id": "CVE-2020-5504",
"lastModified": "2024-11-21T05:34:10.693",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-09T22:15:13.863",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00011.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-12-22 20:55
Modified
2024-11-21 01:32
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la versi\u00f3n de phpMyAdmin v3.4.x y anteriores a v3.4.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de (1) un nombre de base de datos manipulado, relacionados con el panel de sincronizaci\u00f3n de base de datos; (2) un nombre de base de datos manipulado, relacionado con el panel de renombrado de base de datos; (3) una consulta SQL manipulada relacionada con el panel de resumen de base de datos; (4) una consulta SQL manipulada relacionada con el di\u00e1logo de creaci\u00f3n de base de datos; (5) un tipo de columna manipulado, relacionado con la ventana de b\u00fasqueda de tabla; or (6) un nombre de columna manipulado, relacionado con la ventana de di\u00e1logo de creaci\u00f3n de \u00edndice."
}
],
"id": "CVE-2011-4634",
"lastModified": "2024-11-21T01:32:42.307",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-12-22T20:55:00.937",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=077c10020e349e8c1beb46309098992fde616913"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=1490533d91e9d3820e78ca4eac7981886eaea2cb"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b289fe082441dc739939b0ba15dae0d9dc6cee92"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=dac8d6ce256333ff45b5f46270304b8657452740"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071040.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=077c10020e349e8c1beb46309098992fde616913"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=1490533d91e9d3820e78ca4eac7981886eaea2cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b289fe082441dc739939b0ba15dae0d9dc6cee92"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=dac8d6ce256333ff45b5f46270304b8657452740"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-18.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-03-09 17:59
Modified
2024-11-21 02:27
Severity ?
Summary
libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*",
"matchCriteriaId": "FF47C9F0-D8DA-4B55-89EB-9B2C9383ADB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*",
"matchCriteriaId": "56BDB5A0-0839-4A20-A003-B8CD56F48171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "B6360AD1-B295-4123-A6AC-99B13FA12C1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "29255C68-9B71-45DF-95B0-C84762B8CDD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CA9A5D9E-EF89-4F0B-8DA2-B54DAB5616BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AA505-40A6-4767-A848-3B00EA8EDD7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "347983D5-CB40-44C9-8C68-10A8417F4BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "16C9023A-2E9A-4DDA-84A8-D6E2A4F1019F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "564261EC-AEA3-4BDD-9E7D-56B29628D16F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2154D6EC-C492-4035-B5E6-9A5BAB2F2164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "819ECCB5-C0D7-47D0-8479-2C36734F47B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3499F9A7-3F4E-4AD3-94FB-242FD135B851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "53CFCBBC-E941-4167-A474-7C88F6C489AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "CE374D7A-90E3-42A1-A02A-88B03AB70605",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2088A96D-C4C6-4FA9-8594-3DAA81D48443",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F02404-0D50-4222-B24D-6D5E34A6E60F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "254D4A65-99B4-4594-8929-1D0481DB170B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests."
},
{
"lang": "es",
"value": "libraries/select_lang.lib.php en phpMyAdmin 4.0.x anterior a 4.0.10.9, 4.2.x anterior a 4.2.13.2, y 4.3.x anterior a 4.3.11.1 incluye valores de lenguaje inv\u00e1lidos en respuestas de error de lenguaje desconocido que contienen un token CSRF y pueden ser enviadas con la compresi\u00f3n HTTP, lo que facilita a atacantes remotos realizar un ataque BREACH y determinar este token a trav\u00e9s de una serie de respuestas manipuladas."
}
],
"id": "CVE-2015-2206",
"lastModified": "2024-11-21T02:27:00.010",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-03-09T17:59:10.283",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:186"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/72949"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1031871"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/72949"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1031871"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation."
},
{
"lang": "es",
"value": "phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 no elige correctamente delimitadores para prevenir el uso del modificador preg_replace e (tambi\u00e9n conocido como eval), lo que podr\u00eda permitir a atacantes remotos ejecutar un c\u00f3digo PHP arbitrario a trav\u00e9s de una cadena manipulada, como es demostrado por la implementaci\u00f3n de la tabla search-and-replace."
}
],
"id": "CVE-2016-5734",
"lastModified": "2024-11-21T02:54:55.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:24.753",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91387"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/40185/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-27/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91387"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1cc7466db3a05e95fe57a6702f41773e6829d54b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4bcc606225f15bac0b07780e74f667f6ac283da7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/40185/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-27/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-11-17 19:55
Modified
2024-11-21 01:31
Severity ?
Summary
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| fedoraproject | fedora | 14 | |
| fedoraproject | fedora | 15 | |
| fedoraproject | fedora | 16 | |
| debian | debian_linux | 5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "07CC6931-2524-492E-9290-2388CD6435F9",
"versionEndExcluding": "3.3.10.5",
"versionStartIncluding": "3.3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A872DC22-5EB5-4348-BEAD-61A59394AA51",
"versionEndExcluding": "3.4.7.1",
"versionStartIncluding": "3.4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*",
"matchCriteriaId": "BDE52846-24EC-4068-B788-EC7F915FFF11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*",
"matchCriteriaId": "9396E005-22D8-4342-9323-C7DEA379191D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*",
"matchCriteriaId": "706C6399-CAD1-46E3-87A2-8DFE2CF497ED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C757774-08E7-40AA-B532-6F705C8F7639",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack."
},
{
"lang": "es",
"value": "La funci\u00f3n simplexml_load_string en la importaci\u00f3n XML plug-in (libraries/import/xml.php) en phpMyAdmin v3.4.x anterior a v3.4.7.1, v3.3.x y v3.3.10.5 permite a usuarios remotos autenticados leer ficheros arbitrarios a trav\u00e9s de datos XML que contiene entidad de referencia externa, tambi\u00e9n conocido como un XML entidad externa (XXE) ataque de inyecci\u00f3n."
}
],
"id": "CVE-2011-4107",
"lastModified": "2024-11-21T01:31:51.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2011-11-17T19:55:01.517",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/76798"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link",
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2011/Nov/21"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46447"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link"
],
"url": "http://securityreason.com/securityalert/8533"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/50497"
},
{
"source": "secalert@redhat.com",
"tags": [
"Broken Link",
"Exploit"
],
"url": "http://www.wooyun.org/bugs/wooyun-2010-03185"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069625.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069635.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069649.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://osvdb.org/76798"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Exploit"
],
"url": "http://packetstormsecurity.org/files/view/106511/phpmyadmin-fileread.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2011/Nov/21"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://securityreason.com/securityalert/8533"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.openwall.com/lists/oss-security/2011/11/03/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-17.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/50497"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Exploit"
],
"url": "http://www.wooyun.org/bugs/wooyun-2010-03185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=751112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71108"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-611"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-08-01 19:55
Modified
2024-11-21 01:28
Severity ?
Summary
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de salto de directorio en la implementaci\u00f3n del esquema relacional en phpMyAdmin v3.4.x anterior a v3.4.3.2 permite a usuarios autenticados de forma remota incluir y ejecutar ficheros locales a trav\u00e9s de secuencias de salto de directorio en el campo tipo, relacionado con (1)libraries/schema/User_Schema.class.php y (2)schema_export.php."
}
],
"id": "CVE-2011-2718",
"lastModified": "2024-11-21T01:28:49.523",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-08-01T19:55:01.523",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "secalert@redhat.com",
"url": "http://osvdb.org/74111"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725383"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/74111"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=3ae58f0cd6b89ad4767920f9b214c38d3f6d4393"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-11.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725383"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68768"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-20 15:27
Modified
2024-11-21 02:05
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BB75654C-DD14-49AE-B710-DA34D0AA13A6",
"versionEndIncluding": "4.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "36DE9269-E61E-4F24-AC1A-978503933E37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2E1A8297-4418-4DBF-8C53-B5667103DC91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0D75EB-BEA7-4B0A-8CDD-9207350D0D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1CCD716-02E7-4017-98C0-0441D459CAFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C7B2C59-9084-4456-A2BD-8827562F93EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1911AB52-EEA2-45A6-BF52-304B4FF763B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "86F0CCD7-22AB-474F-BFFC-B4AEAD5C02DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.6:a:*:*:*:*:*:*",
"matchCriteriaId": "2412915B-6D01-40D9-AA9B-E09FC1B86E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2D194DB9-CEA9-4571-A5BD-6900C97AA0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D3038292-307C-4FCC-87F7-19FDB183D51E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D2FF9BE0-FEA4-47DA-8558-8959B5612EA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9169B9B4-5E04-45B1-A600-B97B5224D24B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8A5E40DD-F6A3-4D97-8770-4F3776F5CBE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4F6673A9-D214-474B-BC3E-C13ACB3B5204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "15E8363E-3B8A-4248-AFEA-39DE1098712E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "91256645-2A40-4242-B938-234D72C05E20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1BA4F6BA-5678-4D7C-A98F-141079C18523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D06E973A-1C66-43FF-BC61-2FC7DDAFFF57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "169037D5-AEA0-4950-B0BF-EBC9A08AA2DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C9C7CE08-AED8-4D8C-A73F-A69404BAE8DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9A675524-9339-4E5C-9763-2E7EEA6FBCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "42ACF3CF-2BFB-4BA4-9DC1-2B56B847AAF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F81BFCAE-708F-4C0D-8899-DB3E6F08820B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0C7C7E0F-9BF4-4719-97C3-4F395EDCAC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.4:b:*:*:*:*:*:*",
"matchCriteriaId": "AA9D7C76-A7B7-4852-BC34-48C010CA2652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.4:c:*:*:*:*:*:*",
"matchCriteriaId": "CF931388-E9C8-47D7-8A8F-8036B082164E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "460F6547-8606-41BA-BCCD-EB38739EB22A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BAF4BE01-9BD6-492C-85E7-BD3CF08F5EA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "E9C4C7B1-DD4C-4D58-B36E-786797017625",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C36E012-A028-4A47-9EAB-553D18F5E053",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C774C482-4EE2-47DE-BCC4-35020E02A9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "10F44BD9-A868-420B-9B9F-9CC4809A9C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "706127A4-C6E2-4A6C-81EC-3B890E677273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4DB17D6D-14FD-4CEB-96C7-20FCB823D495",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "82EB3D89-67EB-482B-B254-0AB658610E3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F18C84-9F4D-4AE3-8953-638241800D89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en import.php en phpMyAdmin anterior a 4.1.7 permite a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a trav\u00e9s de un nombre de archivo manipulado en una acci\u00f3n import."
}
],
"id": "CVE-2014-1879",
"lastModified": "2024-11-21T02:05:11.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-02-20T15:27:09.547",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/65717"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65717"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/968d5d5f486820bfa30af046f063b9f23304e14a"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-10-16 16:30
Modified
2024-11-21 01:07
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "5899F407-1D31-452A-954C-966895ED7D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFDEFBE-E512-4B0C-BBEC-8FCA29228DDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "CFAD5F7D-AA93-46B7-996B-B0761143B334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1:*:*:*:*:*:*",
"matchCriteriaId": "F0BD3CDF-31C5-4B8A-8314-A5F0F9D28AA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "1DD4EF8B-EA44-46F2-9C28-1D9D1D8BA2CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "426ED65D-8B72-4106-A75E-1CB74106DD46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name for a MySQL table."
},
{
"lang": "es",
"value": "Vulnerabilidad de Ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin v2.11.x anterior a v2.11.9.6 y v3.x anterior a v3.2.2.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un nombre de tabla MySQL manipulado."
}
],
"id": "CVE-2009-3696",
"lastModified": "2024-11-21T01:07:58.877",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-10-16T16:30:00.780",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"source": "cve@mitre.org",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"source": "cve@mitre.org",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"source": "cve@mitre.org",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"source": "cve@mitre.org",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37016"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53742"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37016"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53742"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-10-25 10:51
Modified
2024-11-21 01:44
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin v3.5.x antes de v3.5.3, permiten a usuarios remotos autenticados, ejecutar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un nombre manipulado en (1) un evento, (2) un procedimiento o (3) un disparador."
}
],
"id": "CVE-2012-5339",
"lastModified": "2024-11-21T01:44:32.483",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-10-25T10:51:28.983",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/55925"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/55925"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/6ea8fad3f999bfdf79eb6fe31309592bca54d611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cfd688d2512df9827a8ecc0412fc264fc5bcb186"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI."
},
{
"lang": "es",
"value": "setup/frames/index.inc.php en phpMyAdmin 4.0.10.x en versiones anteriores a 4.0.10.16, 4.4.15.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permite a atacantes remotos llevar a cabo ataques de inyecci\u00f3n BBCode contra sesiones HTTP a trav\u00e9s de una URI manipulada."
}
],
"id": "CVE-2016-5701",
"lastModified": "2024-11-21T02:54:51.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:11.187",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91383"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-17/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91383"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1dca386505f396f0c2035112a403cc80768a141f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-17/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-03-26 14:30
Modified
2024-12-19 17:45
Severity ?
Summary
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 4.0 | |
| debian | debian_linux | 5.0 |
{
"cisaActionDue": "2022-04-15",
"cisaExploitAdd": "2022-03-25",
"cisaRequiredAction": "Apply updates per vendor instructions.",
"cisaVulnerabilityName": "phpMyAdmin Remote Code Execution Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DD88D7DA-16CF-4D83-BB84-6AED7A6B7B4C",
"versionEndExcluding": "2.11.9.5",
"versionStartIncluding": "2.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01E76324-525D-4216-893A-A9C609F9FD09",
"versionEndExcluding": "3.1.3.1",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F92AB32-E7DE-43F4-B877-1F41FA162EC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C757774-08E7-40AA-B532-6F705C8F7639",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo est\u00e1tico en el archivo setup.php en phpMyAdmin v2.11.x anteriores a v2.11.9.5 y v3.x anteriores a v3.1.3.1 que permite a los atacantes remotos inyectar c\u00f3digo PHP arbitrariamente en el archivo de configuraci\u00f3n a trav\u00e9s de la acci\u00f3n guardar."
}
],
"id": "CVE-2009-1151",
"lastModified": "2024-12-19T17:45:24.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2009-03-26T14:30:00.267",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34430"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34642"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35585"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35635"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/archive/1/504191/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/34236"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/8921"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514\u0026r2=12301\u0026pathrev=12301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35585"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35635"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List"
],
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "http://www.gnucitizen.org/blog/cve-2009-1151-phpmyadmin-remote-code-execution-proof-of-concept/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/archive/1/504191/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/34236"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/8921"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-30 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC60DE84-575A-4031-8B78-AD67C60595AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58D3F904-8C3C-46A5-A7A6-8EFA49648687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en libraries/error_report.lib.php en la caracteristica de informe de errores en phpMyAdmin 4.1.x anterior a 4.1.14.7 y 4.2.x anterior a 4.2.12 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de fichero manipulado."
}
],
"id": "CVE-2014-8960",
"lastModified": "2024-11-21T02:20:00.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-11-30T11:59:02.777",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71244"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-15.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71244"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9364e2eee5681681caf7205c0933bc18af11e233"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-08-29 17:55
Modified
2024-11-21 01:29
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.3.0.0 | |
| phpmyadmin | phpmyadmin | 3.3.1.0 | |
| phpmyadmin | phpmyadmin | 3.3.2.0 | |
| phpmyadmin | phpmyadmin | 3.3.3.0 | |
| phpmyadmin | phpmyadmin | 3.3.4.0 | |
| phpmyadmin | phpmyadmin | 3.3.5.0 | |
| phpmyadmin | phpmyadmin | 3.3.5.1 | |
| phpmyadmin | phpmyadmin | 3.3.6 | |
| phpmyadmin | phpmyadmin | 3.3.7 | |
| phpmyadmin | phpmyadmin | 3.3.8 | |
| phpmyadmin | phpmyadmin | 3.3.8.1 | |
| phpmyadmin | phpmyadmin | 3.3.9.0 | |
| phpmyadmin | phpmyadmin | 3.3.9.1 | |
| phpmyadmin | phpmyadmin | 3.3.9.2 | |
| phpmyadmin | phpmyadmin | 3.3.10.0 | |
| phpmyadmin | phpmyadmin | 3.3.10.1 | |
| phpmyadmin | phpmyadmin | 3.3.10.2 | |
| phpmyadmin | phpmyadmin | 3.3.10.3 | |
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E3E72232-C7D1-4D3E-97D1-5F3B89D447ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3540439C-52FD-45A7-ABF4-E18C4AED89C4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la caracter\u00edstica de Tracking en phpMyAdmin v3.3.x anterior a v3.3.10.4 y 3.4.x anterior a v3.4.4 permite a atacantes remotos inyectar script web de su elecci\u00f3n o HTML a trav\u00e9s de un (1) nombre de tabla, (2) nombre de columna, o (2) nombre de index."
}
],
"id": "CVE-2011-3181",
"lastModified": "2024-11-21T01:29:55.260",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-08-29T17:55:01.033",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45709"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/45990"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/49306"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=733475"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45709"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45990"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/49306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=733475"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-05 01:59
Modified
2024-11-21 02:53
Severity ?
Summary
Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.2 | |
| opensuse | opensuse | 13.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en libraries/error_report.lib.php en phpMyAdmin en versiones anteriores a 4.6.2-prerelease permite a atacantes remotos determinar la existencia de archivos arbitrarios desencadenando un error."
}
],
"evaluatorComment": "Per \u003ca href=\"https://www.phpmyadmin.net/security/PMASA-2016-15/\"\u003eVendor Advisory\u003c/a\u003e: \"No released version was vulnerable.\"",
"id": "CVE-2016-5098",
"lastModified": "2024-11-21T02:53:37.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-05T01:59:06.677",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1035980"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1035980"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d2dc9481d2af25b035778c67eaf0bfd2d2c59dd8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-15"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/92500 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-56 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92500 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-56 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. phpMyAdmin puede ser utilizado para desencadenar un ataque remoto de ejecuci\u00f3n de c\u00f3digo contra ciertas instalaciones PHP que se ejecutan con la extensi\u00f3n dbase. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6633",
"lastModified": "2024-11-21T02:56:31.387",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:43.303",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92500"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-56"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92500"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-56"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-10-03 04:03
Modified
2024-11-21 00:17
Severity ?
Summary
phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.1 | |
| phpmyadmin | phpmyadmin | 2.8.0.2 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 | |
| phpmyadmin | phpmyadmin | 2.8.1 | |
| phpmyadmin | phpmyadmin | 2.8.1_dev | |
| phpmyadmin | phpmyadmin | 2.8.3 | |
| phpmyadmin | phpmyadmin | 2.8.4 | |
| phpmyadmin | phpmyadmin | 2.9.0_dev |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files."
},
{
"lang": "es",
"value": "phpMyAdmin anterior a 2.9.1-rc1 tiene un directorio de librerias bajo la ra\u00edz de la documentaci\u00f3n web con controles de acceso insuficientes, lo caul permiet a un atacante remoto obtener informaci\u00f3n sensible a trav\u00e9s de repuesta directar para cierto archivos."
}
],
"id": "CVE-2006-5117",
"lastModified": "2024-11-21T00:17:56.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-10-03T04:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22126"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22126"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/20253"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-11-15 00:46
Modified
2024-11-21 00:39
Severity ?
Summary
SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65E755CE-C312-427E-B256-4F743D77FF75",
"versionEndIncluding": "2.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en el db_create.php en el phpMyAdmin anterior al 2.11.2.1 permite a usuarios remotos autenticados con privilegios de CREATE DATABASE ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro db."
}
],
"id": "CVE-2007-5976",
"lastModified": "2024-11-21T00:39:05.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-11-15T00:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27630"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27753"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38403"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27630"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27753"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-26 03:34
Modified
2024-11-21 01:53
Severity ?
Summary
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename."
},
{
"lang": "es",
"value": "phpMyAdmin v3.5.x antes de v3.5.8 y v4.x antes de v4.0.0-RC3, cuando se configura un directorio SaveDir, permite a los usuarios remotos autenticados ejecutar c\u00f3digo arbitrario mediante una doble extensi\u00f3n del nombre de archivo de un archivo de exportaci\u00f3n, lo que lleva a la interpretaci\u00f3n de este archivo como un archivo ejecutable por el Apache HTTP Server, como se demuestra por un nombre de archivo .php.sql"
}
],
"id": "CVE-2013-3239",
"lastModified": "2024-11-21T01:53:14.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-04-26T03:34:23.463",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a"
},
{
"source": "cve@mitre.org",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1f6bc0b707002e26cab216b9e57b4d5de764de48"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d3fafdfba0807068196655e9b6d16c5d1d3ccf8a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-31 17:15
Modified
2024-11-21 04:57
Severity ?
Summary
phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/issues/16056 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/issues/16056 | Exploit, Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 5.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "310D977D-2D64-4817-B054-2AC6CE7C6237",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states \"I don\u0027t see anything specifically exploitable."
},
{
"lang": "es",
"value": "** EN DISPUTA ** phpMyAdmin versi\u00f3n 5.0.2, permite una inyecci\u00f3n CRLF, como es demostrado por las entradas %0D%0Astring%0D%0A en los campos del formulario de inicio de sesi\u00f3n, causando que las secuencias de tipo CRLF sean reflejadas sobre una p\u00e1gina de error. NOTA: el proveedor declara \"No veo nada espec\u00edficamente explotable\"."
}
],
"id": "CVE-2020-11441",
"lastModified": "2024-11-21T04:57:55.437",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-31T17:15:26.497",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/16056"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/16056"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-01-26 15:55
Modified
2024-11-21 01:27
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.3.0.0 | |
| phpmyadmin | phpmyadmin | 3.3.1.0 | |
| phpmyadmin | phpmyadmin | 3.3.2.0 | |
| phpmyadmin | phpmyadmin | 3.3.3.0 | |
| phpmyadmin | phpmyadmin | 3.3.4.0 | |
| phpmyadmin | phpmyadmin | 3.3.5.0 | |
| phpmyadmin | phpmyadmin | 3.3.5.1 | |
| phpmyadmin | phpmyadmin | 3.3.6 | |
| phpmyadmin | phpmyadmin | 3.3.7 | |
| phpmyadmin | phpmyadmin | 3.3.8 | |
| phpmyadmin | phpmyadmin | 3.3.8.1 | |
| phpmyadmin | phpmyadmin | 3.3.9.0 | |
| phpmyadmin | phpmyadmin | 3.3.9.1 | |
| phpmyadmin | phpmyadmin | 3.3.9.2 | |
| phpmyadmin | phpmyadmin | 3.3.10.0 | |
| phpmyadmin | phpmyadmin | 3.4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin v3.3.x anterior a v3.3.10.1 y v3.4.x anterior a v3.4.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un nombre de tabla dise\u00f1ada que provoca la prestaci\u00f3n inadecuada HTML en una p\u00e1gina de seguimiento , en relaci\u00f3n con (1) bibliotecas / tbl_links.inc.php y tbl_tracking.php (2)."
}
],
"id": "CVE-2011-1940",
"lastModified": "2024-11-21T01:27:21.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-01-26T15:55:01.360",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d4088130637d8dee918492"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=7e10c132a3887c8ebfd7a8eee356b28375f1e287"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=d3ccf798fdbd4f8a89d4088130637d8dee918492"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-3.php"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link."
},
{
"lang": "es",
"value": "Vulnerabilidad XSS enlibraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php en phpMyAdmin 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar secuencias web o HTML arbitrarias a trav\u00e9s de un nombre de objeto modificado asociado a un enlace TextLinkTransformationPlugin."
}
],
"id": "CVE-2013-5001",
"lastModified": "2024-11-21T01:56:52.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-31T13:20:08.653",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-16 14:04
Modified
2024-11-21 01:50
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:rc1:*:*:*:*:*:*",
"matchCriteriaId": "8256D77D-B4D1-4D2C-8F49-D080B805F238",
"versionEndIncluding": "3.5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "secalert@redhat.com",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is \"not exploitable."
},
{
"lang": "es",
"value": "** EN DISPUTA ** M\u00faltiples vulnerabilidades Cross-Site Scripting (XSS) en tbl_gis_visualization.php en phpMyAdmin, en versiones 3.5.x anteriores a la 3.5.8, permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante los par\u00e1metros (1) visualizationSettings[width] o (2) visualizationSettings[height]. NOTA: un tercero reporta que esto \"no puede explotarse\"."
}
],
"id": "CVE-2013-1937",
"lastModified": "2024-11-21T01:50:42.647",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2013-04-16T14:04:31.253",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html"
},
{
"source": "secalert@redhat.com",
"url": "http://immunityservices.blogspot.com/2019/02/cvss.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2013/04/09/13"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:144"
},
{
"source": "secalert@redhat.com",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://www.waraxe.us/advisory-102.html"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0101.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://immunityservices.blogspot.com/2019/02/cvss.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103184.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103188.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103195.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2013/04/09/13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:144"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.waraxe.us/advisory-102.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-10-03 04:03
Modified
2024-11-21 00:17
Severity ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.1 | |
| phpmyadmin | phpmyadmin | 2.8.0.2 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 | |
| phpmyadmin | phpmyadmin | 2.8.1 | |
| phpmyadmin | phpmyadmin | 2.8.1_dev | |
| phpmyadmin | phpmyadmin | 2.8.3 | |
| phpmyadmin | phpmyadmin | 2.8.4 | |
| phpmyadmin | phpmyadmin | 2.9.0_dev |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the _REQUEST array, related to (a) libraries/common.lib.php, (b) session.inc.php, and (c) url_generating.lib.php. NOTE: the PHP unset function vector is covered by CVE-2006-3017."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en phpMyAdmin anteror a 2.9.1-rc1 rem realizar acciones no autorizadas como otro usuario (1) estableciendo directamente un testigo en el URL mediante evaluaci\u00f3n din\u00e1mica de variable y (2) cambiar variables de su elecci\u00f3n mediante el array _REQUEST, relacionado con (a) libraries/common.lib.php, (b) session.inc.php, y (3) url_generating.lib.php. NOTA: el vector de la funci\u00f3n unset de PHP se trata en CVE-2006-3017."
}
],
"id": "CVE-2006-5116",
"lastModified": "2024-11-21T00:17:56.077",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2006-10-03T04:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://attrition.org/pipermail/vim/2006-October/001067.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22126"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1677"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "cve@mitre.org",
"url": "http://www.hardened-php.net/advisory_072006.130.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/447491/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://attrition.org/pipermail/vim/2006-October/001067.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://prdownloads.sourceforge.net/phpmyadmin/phpMyAdmin-2.9.1-rc1.tar.gz?download"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22126"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1677"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.hardened-php.net/advisory_072006.130.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/447491/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/20253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29301"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario autorizado puede provocar una ataque de denegaci\u00f3n de servicio (DoS) en un servidor pasando valores grandes en un bucle. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6623",
"lastModified": "2024-11-21T02:56:29.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:30.893",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95052"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-46"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-46"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-01-19 16:30
Modified
2024-11-21 01:10
Severity ?
Summary
scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.0 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3.0 | |
| phpmyadmin | phpmyadmin | 2.11.4.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.1 | |
| phpmyadmin | phpmyadmin | 2.11.5.2 | |
| phpmyadmin | phpmyadmin | 2.11.6.0 | |
| phpmyadmin | phpmyadmin | 2.11.7.0 | |
| phpmyadmin | phpmyadmin | 2.11.7.1 | |
| phpmyadmin | phpmyadmin | 2.11.8.0 | |
| phpmyadmin | phpmyadmin | 2.11.9.0 | |
| phpmyadmin | phpmyadmin | 2.11.9.1 | |
| phpmyadmin | phpmyadmin | 2.11.9.2 | |
| phpmyadmin | phpmyadmin | 2.11.9.3 | |
| phpmyadmin | phpmyadmin | 2.11.9.4 | |
| phpmyadmin | phpmyadmin | 2.11.9.5 | |
| phpmyadmin | phpmyadmin | 2.11.9.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "scripts/setup.php (aka the setup script) in phpMyAdmin 2.11.x before 2.11.10 calls the unserialize function on the values of the (1) configuration and (2) v[0] parameters, which might allow remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors."
},
{
"lang": "es",
"value": "scripts/setup.php (tambi\u00e9n conocido como secuencias de comandos de instalaci\u00f3n) en phpMyAdmin v2.11.x anterior a v2.11.10 llama a la funci\u00f3n unserialize en los valores de la (1) configuraci\u00f3n y (2) v[0] par\u00e1metros, lo que podr\u00eda permitir a atacantes remotos dirigir ataques de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) a trav\u00e9s de vectores sin especificar."
}
],
"id": "CVE-2009-4605",
"lastModified": "2024-11-21T01:10:01.900",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-01-19T16:30:00.977",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/39503"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/scripts/setup.php?r1=13149\u0026r2=13148\u0026pathrev=13149"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=13149"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/39503"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/0910"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 | |
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.4.15.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Llamando a algunas secuencias de comandos que son parte de phpMyAdmin de forma inesperada, es posible desencadenar phpMyAdmin para mostrar un mensaje de error de PHP que contiene la ruta completa del directorio donde phpMyAdmin est\u00e1 instalado. Durante un tiempo de espera de ejecuci\u00f3n en la funcionalidad de exportaci\u00f3n, los errores que contienen la ruta completa del directorio de phpMyAdmin se escriben en el archivo de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas. Esta CVE es para el problema del curl wrapper."
}
],
"id": "CVE-2016-9852",
"lastModified": "2024-11-21T03:01:52.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:50.380",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message."
},
{
"lang": "es",
"value": "phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de vectores relacionados con (1) un valor de matriz para FormDisplay.php, (2) datos incorrectos para validate.php, (3) datos no esperados para Validator.php, (4) falta de directorio de configuraci\u00f3n durante la instalaci\u00f3n o (5) un identificador de tipo de datos OpenID incorrecto, lo que revela la ruta completa en un mensaje de error."
}
],
"id": "CVE-2016-5730",
"lastModified": "2024-11-21T02:54:54.527",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:20.237",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91379"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-23/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91379"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27664605b945b13e1d2b71adea822ace2099cc96"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/331c560fbfa0e7d2dce674b5e88e983c5f2a451d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/96e0aa35653ec0c66084a7e9343465e16c1f769b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b0180f18c828706af3a6800f0fb01a536d3ef8c7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-23/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files."
},
{
"lang": "es",
"value": "phpMyAdmin 3.5.x anterior a 3.5.8.2, permite a a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n inv\u00e1lida, que muestra la ruta de instalaci\u00f3n en un mensaje de error. Relacionado con config.default.php y otros archivos."
}
],
"id": "CVE-2013-5000",
"lastModified": "2024-11-21T01:56:52.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-31T13:20:08.643",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 3.5.x anterior a 3.5.8.2, permite a atacantes remotos inyectar secuencias de comandos web y HTML arbitrarias a trav\u00e9s de vectores que involucran un evento JavaScript en (1) un identificador de ancla a setup/index.php oa (2) un valor chartTitle (aka chart title)."
}
],
"id": "CVE-2013-4997",
"lastModified": "2024-11-21T01:56:52.020",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-31T13:20:08.590",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-05 18:28
Modified
2024-11-21 00:24
Severity ?
Summary
phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.9.1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message."
},
{
"lang": "es",
"value": "phpMyAdmin 2.9.1.1 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de respuestas directas para themes/darkblue_orange/layout.inc.php, lo cual revela la ruta en un mensaje de error."
}
],
"id": "CVE-2007-0095",
"lastModified": "2024-11-21T00:24:57.510",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-05T18:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/33257"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2104"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0034.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/051544.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/33257"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2104"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31223"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94534 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-62 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94534 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-62 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.4.15.8 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con un valor de par\u00e1metro de solicitud manipulado es posible eludir el tiempo de espera de cierre de sesi\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9851",
"lastModified": "2024-11-21T03:01:52.830",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:49.193",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94534"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-62"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94534"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-62"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-10-10 19:15
Modified
2024-11-21 05:20
Severity ?
Summary
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B5118B29-48B2-42DF-BB11-7DE3643EED23",
"versionEndExcluding": "4.9.6",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0EBDC3AD-0E2E-4C86-B0D8-5E7D9E23656E",
"versionEndExcluding": "5.0.3",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en SearchController en phpMyAdmin versiones anteriores a 4.9.6 y versiones 5.x anteriores a 5.0.3. Se detect\u00f3 una vulnerabilidad de inyecci\u00f3n SQL en c\u00f3mo phpMyAdmin procesa las sentencias SQL en la funcionalidad de b\u00fasqueda. Un atacante podr\u00eda usar este fallo para inyectar SQL malicioso en una consulta"
}
],
"id": "CVE-2020-26935",
"lastModified": "2024-11-21T05:20:32.170",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-10T19:15:12.370",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4281"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-6/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://advisory.checkmarx.net/advisory/CX-2020-4281"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-6/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-04-18 10:02
Modified
2024-11-21 00:09
Severity ?
Summary
SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0_pl1 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to execute arbitrary SQL commands via the sql_query parameter."
}
],
"evaluatorSolution": "This vulnerbability may affect earlier versions of phpMyAdmin as well.",
"id": "CVE-2006-1804",
"lastModified": "2024-11-21T00:09:48.147",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-04-18T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25858"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-12-22 20:55
Modified
2024-11-21 01:32
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 | |
| phpmyadmin | phpmyadmin | 3.4.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en libraries/display_export.lib.php en phpMyAdmin v3.4.x antes de v3.4.9, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un los siguientes par\u00e1metros de URL modificados (1) server, (2) database, y(3) table sections,"
}
],
"id": "CVE-2011-4780",
"lastModified": "2024-11-21T01:32:59.440",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-12-22T20:55:00.983",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=bd3735ba584e7a49aee78813845245354b061f61"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/51226"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=bd3735ba584e7a49aee78813845245354b061f61"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-20.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/51226"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://securitytracker.com/id?1013210 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://securitytracker.com/id?1013210 | Exploit, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "704C4359-A80E-456F-AA69-D188E4DFDBA9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message."
}
],
"id": "CVE-2005-0459",
"lastModified": "2024-11-20T23:55:10.410",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1013210"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://securitytracker.com/id?1013210"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-10-24 10:02
Modified
2024-11-21 00:01
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.4 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl2 | |
| phpmyadmin | phpmyadmin | 2.6.4_rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "33423F75-0F5A-49F6-BF70-66DC2CE39E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl3 allow remote attackers to inject arbitrary web script or HTML via certain arguments to (1) left.php, (2) queryframe.php, or (3) server_databases.php."
}
],
"id": "CVE-2005-3301",
"lastModified": "2024-11-21T00:01:34.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-10-24T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15196"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/2179"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15196"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/2179"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-08-13 21:17
Modified
2024-11-21 00:35
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.10.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.10.3 allow remote attackers to inject arbitrary web script or HTML via the (1) unlim_num_rows, (2) sql_query, or (3) pos parameter to (a) tbl_export.php; the (4) session_max_rows or (5) pos parameter to (b) sql.php; the (6) username parameter to (c) server_privileges.php; or the (7) sql_query parameter to (d) main.php. NOTE: vector 5 might be a regression or incomplete fix for CVE-2006-6942.7."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin 2.10.3 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros 1) unlim_num_rows, (2) sql_query, o (3) pos de (a) tbl_export.php; los par\u00e1metros (4) session_max_rows or (5) pos parameter de (b) sql.php; el par\u00e1metro (6) username de (c) server_privileges.php; o el par\u00e1metro (7) sql_query de (d) main.php. NOTA: el vector 5 podr\u00eda ser una regresi\u00f3n o soluci\u00f3n incompleta para CVE-2006-6942.7."
}
],
"id": "CVE-2007-4306",
"lastModified": "2024-11-21T00:35:16.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-08-13T21:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/25268"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://pridels-team.blogspot.com/2007/08/phpmyadmin-multiple-xss-vuln.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/25268"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-01-22 02:15
Modified
2024-11-21 06:49
Severity ?
Summary
An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5CC886AA-A01D-413D-9F3A-CF2435D94779",
"versionEndExcluding": "4.9.8",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45AFD905-B58E-42E9-9682-3CB2E644DCFF",
"versionEndExcluding": "5.1.2",
"versionStartIncluding": "5.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances."
},
{
"lang": "es",
"value": "Se ha detectado un problema en phpMyAdmin versiones 4.9 anteriores a 4.9.8 y 5.1 anteriores a 5.1.2. Un usuario v\u00e1lido que ya est\u00e1 autenticado en phpMyAdmin puede manipular su cuenta para omitir la autenticaci\u00f3n de dos factores en futuras instancias de inicio de sesi\u00f3n"
}
],
"id": "CVE-2022-23807",
"lastModified": "2024-11-21T06:49:17.580",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-22T02:15:07.150",
"references": [
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-10-23 21:02
Modified
2024-11-21 00:01
Severity ?
Summary
PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.4 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter, possibly involving the subform array."
}
],
"id": "CVE-2005-3299",
"lastModified": "2024-11-21T00:01:33.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-10-23T21:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17137"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/69"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17137"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/69"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-16.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15053"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-03-07 21:19
Modified
2024-11-21 00:28
Severity ?
Summary
The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "63623FC3-197D-4308-9077-F40B4B3F0F97",
"versionEndIncluding": "2.10.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The PMA_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by users, which allows context-dependent attackers to cause a denial of service (web server crash) via an array with many dimensions. NOTE: it could be argued that this vulnerability is caused by a problem in PHP (CVE-2006-1549) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in phpMyAdmin."
},
{
"lang": "es",
"value": "La funci\u00f3n PMA_ArrayWalkRecursive en el libraries/common.lib.php del phpMyAdmin anterior al 2.10.0.2 no tiene l\u00edmite en la recursividad de los arrays proporcionados por los usuarios, lo que permite a atacantes dependientes del contexto provocar una denegaci\u00f3n de servicio (ca\u00edda del servidor web) mediante un array con m\u00faltiples dimensiones. NOTA: puede ser discutido que esta vulnerabilidad est\u00e1 provocada por un problema en el PHP (CVE-2006-1549) y la soluci\u00f3n adecuada debe de ser en PHP; con lo cual esto no deber\u00eda ser tratado como una vulnerabilidad en el phpMyAdmin."
}
],
"evaluatorComment": "This vulnerability is addressed in the following product update:\r\nhttp://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3",
"id": "CVE-2007-1325",
"lastModified": "2024-11-21T00:28:02.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-03-07T21:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/36834"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.php-security.org/MOPB/MOPB-02-2007.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.php.net/ChangeLog-4.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.php.net/releases/4_4_8.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22841"
},
{
"source": "cve@mitre.org",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/36834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1671813\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.php-security.org/MOPB/MOPB-02-2007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.php.net/ChangeLog-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.php.net/releases/4_4_8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/22841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0831"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.4.15.8 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Llamando a algunas secuencias de comandos que son parte de phpMyAdmin de forma inesperada, es posible desencadenar phpMyAdmin para mostrar un mensaje de error de PHP que contiene la ruta completa del directorio donde phpMyAdmin est\u00e1 instalado. Durante un tiempo de espera de ejecuci\u00f3n en la funcionalidad de exportaci\u00f3n, los errores que contienen la ruta completa del directorio de phpMyAdmin se escriben en el archivo de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas. Esta CVE es para el problema del fopen wrapper."
}
],
"id": "CVE-2016-9853",
"lastModified": "2024-11-21T03:01:53.137",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:51.477",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94118 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-33 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94118 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-33 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Una vulnerabilidad de divulgaci\u00f3n de ruta completa se descubri\u00f3 en phpMyAdmin donde un usuario puede desencadenar un error particular en el mecanismo de exportaci\u00f3n para descubrir la ruta completa de phpMyAdmin en el disco. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6610",
"lastModified": "2024-11-21T02:56:26.413",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:15.487",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94118"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-33"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94118"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-33"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-10-28 19:46
Modified
2024-11-21 00:52
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.11.9.2 | |
| phpmyadmin | phpmyadmin | 3.0.0 | |
| phpmyadmin | phpmyadmin | 3.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in pmd_pdf.php in phpMyAdmin 3.0.0, and possibly other versions including 2.11.9.2 and 3.0.1, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the db parameter, a different vector than CVE-2006-6942 and CVE-2007-5977."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en pmd_pdf.php en phpMyAdmin v3.0.0, y posiblemente otras versiones incluyendo v2.11.9.2 y v3.0.1, cuando register_globals est\u00e1 activo, permite a atacantes remotos inyectar web script o HTML a trav\u00e9s del par\u00e1metro \"db\", un vector diferente a CVE-2006-6942 y CVE-2007-5977."
}
],
"id": "CVE-2008-4775",
"lastModified": "2024-11-21T00:52:31.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-10-28T19:46:09.977",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32449"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32482"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/4516"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/497815/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/31928"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2943"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46136"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32482"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/4516"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/497815/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/31928"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00908.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00925.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-24 01:03
Modified
2024-11-21 00:02
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.2.0 | |
| phpmyadmin | phpmyadmin | 2.2.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.1_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.3_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog."
}
],
"id": "CVE-2005-3787",
"lastModified": "2024-11-21T00:02:40.823",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-24T01:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17578"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/16389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17578"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/16389"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-09-08 20:00
Modified
2024-11-21 01:17
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados en libraries/Error.class.php en phpMyAdmin v3.x anterior a v3.3.6, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores relacionados con un backtrace y mensajes de error (tambi\u00e9n conocidos como mensajes de depuraci\u00f3n). Vulnerabilidad distinta de CVE-2010-3056."
}
],
"id": "CVE-2010-2958",
"lastModified": "2024-11-21T01:17:44.100",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-09-08T20:00:03.590",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41206"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/3"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2242"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41206"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/09/01/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2242"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94523 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-59 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94523 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-59 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. phpinfo (phpinfo.php) muestra informaci\u00f3n PHP incluyendo valores de cookies HttpOnly. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9848",
"lastModified": "2024-11-21T03:01:52.353",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:45.757",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94523"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-59"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94523"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-59"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-19 02:28
Modified
2024-11-21 00:24
Severity ?
Summary
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 2.9.0 | |
| phpmyadmin | phpmyadmin | 2.9.0.1 | |
| phpmyadmin | phpmyadmin | 2.9.0.2 | |
| phpmyadmin | phpmyadmin | 2.9.0.3 | |
| phpmyadmin | phpmyadmin | 2.9.0_beta1 | |
| phpmyadmin | phpmyadmin | 2.9.0_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5DE07071-A27E-4BC0-937C-32415A6A6C03",
"versionEndIncluding": "2.9.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers."
},
{
"lang": "es",
"value": "phpMyAdmin versiones anteriores a 2.9.1.1 permite a atacantes remotos evitar reglas de acceso Permitir/Denegar que usan direcciones IP mediante cabeceras falsas."
}
],
"id": "CVE-2006-6944",
"lastModified": "2024-11-21T00:24:01.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-19T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9"
},
{
"source": "cve@mitre.org",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/4572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/4572"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php."
},
{
"lang": "es",
"value": "Vulnerabilidad XSS en libraries/schema/Export_Relation_Schema.class.php en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar secuencias web o HTML arbitrarias a trav\u00e9s de un valor modificado de pageNumber a Schema_export.php."
}
],
"id": "CVE-2013-5002",
"lastModified": "2024-11-21T01:56:52.743",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-31T13:20:08.660",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61516"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-14.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61516"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-03-01 11:59
Modified
2024-11-21 02:48
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 | |
| phpmyadmin | phpmyadmin | 4.5.3.1 | |
| phpmyadmin | phpmyadmin | 4.5.4 | |
| phpmyadmin | phpmyadmin | 4.5.4.1 | |
| phpmyadmin | phpmyadmin | 4.5.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F90283AD-A616-403C-BE69-BCB2FD58A2CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "043B846F-4CDF-402A-B14A-B4949B1D403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C7B52D3D-C5F0-4793-AFA3-C518400DB71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476503-1A1B-408B-9E66-1E4940090AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7123D6E6-3AE7-4413-AD6E-0D68D44C6F94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05A2EBE2-E55C-45DF-A74C-1B5F7E6EEC25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "909DFCAB-A44B-4EB8-B54D-066699AE760B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la funci\u00f3n format en libraries/sql-parser/src/Utils/Error.php en el int\u00e9rprete SQL en phpMyAdmin 4.5.x en versiones anteriores a 4.5.5.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una petici\u00f3n manipulada."
}
],
"id": "CVE-2016-2559",
"lastModified": "2024-11-21T02:48:41.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-03-01T11:59:00.190",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-10/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a505fc1fe0df32c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-10/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files."
},
{
"lang": "es",
"value": "phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n inv\u00e1lida, que revela la ruta de instalaci\u00f3n en un mensaje de error. Relacionado con pmd_common.php y otros archivos."
}
],
"id": "CVE-2013-4998",
"lastModified": "2024-11-21T01:56:52.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-31T13:20:08.623",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con un valor de par\u00e1metro de solicitud manipulado es posible iniciar un ataque de denegaci\u00f3n de servicio en la funcionalidad de b\u00fasquedas guardadas. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9858",
"lastModified": "2024-11-21T03:01:53.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:57.897",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-03-26 14:30
Modified
2024-11-21 01:01
Severity ?
Summary
Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 3.1.0 | |
| phpmyadmin | phpmyadmin | 3.1.0.0 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9B142F14-A80C-4B95-86C9-0B57436AE8FA",
"versionEndIncluding": "3.1.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to read arbitrary files via directory traversal sequences in the file_path parameter ($filename variable)."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en el archivo bs_disp_as_mime_type.php en la caracter\u00edstica BLOB streaming en phpMyAdmin anteriores a 3.1.3.1 que permite a los atacantes remotos leer arbitrariamente archivo a trav\u00e9s de secuencias de salto de directorio en el par\u00e1metro file_path (variable $filename)."
}
],
"id": "CVE-2009-1148",
"lastModified": "2024-11-21T01:01:46.780",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-03-26T14:30:00.203",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34468"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34642"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303\u0026r2=12302\u0026pathrev=12303"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34468"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-04-11 00:02
Modified
2024-11-21 00:09
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F14B08F-6583-4686-B534-616D42B7D90B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "D4CD5425-79A4-4506-8BDA-299449EB51DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F754BBA9-765F-4BDE-9AF3-3DA4300B17C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "7A136E97-05EA-4ADF-82F5-E2D0C7737D6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "53AE58C1-CB8C-415F-BF58-BD356D3AC000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory."
}
],
"id": "CVE-2006-1678",
"lastModified": "2024-11-21T00:09:28.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-04-11T00:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19556"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/24450"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/17390"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1263"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25689"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19556"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/24450"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/17390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25689"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-12-06 03:15
Modified
2024-11-21 04:35
Severity ?
Summary
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DCA8C-1CE7-4518-B9EC-5D368AC1057F",
"versionEndExcluding": "4.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php."
},
{
"lang": "es",
"value": "phpMyAdmin versiones anteriores a 4.9.2 no escapa determinada informaci\u00f3n de Git, relacionada con las bibliotecas libraries/classes/Display/GitRevision.php y libraries/classes/Footer.php."
}
],
"id": "CVE-2019-19617",
"lastModified": "2024-11-21T04:35:04.343",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-06T03:15:10.607",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un atacante podr\u00eda redirigir a un usuario a una p\u00e1gina web maliciosa. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6626",
"lastModified": "2024-11-21T02:56:30.253",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:34.800",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92490"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-49"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92490"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-49"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un atacante puede ser capaz de activar a un usuario para descargar un archivo SVG malicioso especialmente manipulado. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6628",
"lastModified": "2024-11-21T02:56:30.577",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:37.333",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92492"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-51"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92492"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-51"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-12-17 02:30
Modified
2024-11-21 00:54
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0.0 | |
| phpmyadmin | phpmyadmin | 2.11.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.0 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3 | |
| phpmyadmin | phpmyadmin | 2.11.3.0 | |
| phpmyadmin | phpmyadmin | 2.11.4.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.1 | |
| phpmyadmin | phpmyadmin | 2.11.5.2 | |
| phpmyadmin | phpmyadmin | 2.11.6.0 | |
| phpmyadmin | phpmyadmin | 2.11.7 | |
| phpmyadmin | phpmyadmin | 2.11.7.0 | |
| phpmyadmin | phpmyadmin | 2.11.8 | |
| phpmyadmin | phpmyadmin | 2.11.9.0 | |
| phpmyadmin | phpmyadmin | 2.11.9.1 | |
| phpmyadmin | phpmyadmin | 2.11.9.2 | |
| phpmyadmin | phpmyadmin | 2.11.9.3 | |
| phpmyadmin | phpmyadmin | 3.0.0 | |
| phpmyadmin | phpmyadmin | 3.0.1 | |
| phpmyadmin | phpmyadmin | 3.1.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable, but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en phpMyAdmin v2.11.x anterior a v2.11.9.4 y v3.x anterior a v3.1.1.0; permite a atacantes remotos realizar acciones no autorizadas como administrador a trav\u00e9s de un enlace o etiqueta IMG a tbl_structure.php con un par\u00e1metro \"table\" (tabla) modificado. NOTA: esto puede ser utilizar para realizar ataques de inyecci\u00f3n SQL y ejecutar c\u00f3digo arbitrariamente."
}
],
"id": "CVE-2008-5621",
"lastModified": "2024-11-21T00:54:29.200",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-12-17T02:30:00.280",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/50894"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33076"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33146"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33246"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33912"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/4753"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2009/dsa-1723"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2009/02/12/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/32720"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/3402"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/3501"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47168"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/7382"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/50894"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33076"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33246"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33912"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/4753"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20081222-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2009/dsa-1723"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2009/02/12/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2008-10.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/32720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/3402"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/3501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/7382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00784.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-10-25 10:51
Modified
2024-11-21 01:44
Severity ?
Summary
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code."
},
{
"lang": "es",
"value": "phpMyAdmin v3.5.x antes de v3.5.3 utiliza c\u00f3digo JavaScript que se obtiene a trav\u00e9s de una sesi\u00f3n HTTP para phpmyadmin.net sin SSL, que permite a atacantes man-in-the-middle realizar ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) mediante la modificaci\u00f3n de este c\u00f3digo."
}
],
"id": "CVE-2012-5368",
"lastModified": "2024-11-21T01:44:36.547",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-10-25T10:51:29.030",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/55939"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-11/msg00033.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/55939"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/50edafc0884aa15d0a1aa178089ac6a1ad2eb18a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/a547f3d3e2cf36c6a904fa3e053fd8bddd3fbbb0"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a atacantes remotos inyectar secuencias de comandos web y HTML arbitrarias a trav\u00e9s de vectores que involucran (1) un nombre de base de datos manipulado, (2) un nombre de usuarios manipulado, (3) una URL del logo manipulada en el panel de navegaci\u00f3n, (4) una entrada manipulada en una lista de proxies determinada o(5) un contenido manipulado en el archivo version.json ."
}
],
"id": "CVE-2013-4996",
"lastModified": "2024-11-21T01:56:51.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-31T13:20:08.557",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61921"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-11.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61921"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-02-24 05:00
Modified
2024-11-20 23:55
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.0_pl2 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.1 | |
| phpmyadmin | phpmyadmin | 2.6.1_rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary HTML and web script via (1) the strServer, cfg[BgcolorOne], or strServerChoice parameters in select_server.lib.php, (2) the bg_color or row_no parameters in display_tbl_links.lib.php, the left_font_family parameter in theme_left.css.php, or the right_font_family parameter in theme_right.css.php."
}
],
"id": "CVE-2005-0543",
"lastModified": "2024-11-20T23:55:22.453",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-02-24T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/12644"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19462"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149383\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/12644"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19462"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-03-01 11:59
Modified
2024-11-21 02:48
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F90283AD-A616-403C-BE69-BCB2FD58A2CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "043B846F-4CDF-402A-B14A-B4949B1D403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C7B52D3D-C5F0-4793-AFA3-C518400DB71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476503-1A1B-408B-9E66-1E4940090AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7123D6E6-3AE7-4413-AD6E-0D68D44C6F94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05A2EBE2-E55C-45DF-A74C-1B5F7E6EEC25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "909DFCAB-A44B-4EB8-B54D-066699AE760B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.5 y 4.5.x en versiones anteriores a 4.5.5.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) normalization.php o (2) js/normalization.js en la p\u00e1gina de normalizaci\u00f3n de la base de datos, (3) templates/database/structure/sortable_header.phtml en la p\u00e1gina de estructura de la base de datos, o (4) el par\u00e1metro pos parameter en db_central_columns.php en la p\u00e1gina central columns."
}
],
"id": "CVE-2016-2561",
"lastModified": "2024-11-21T02:48:42.087",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-03-01T11:59:03.533",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-12/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08f2e3ac19cbbef"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa1cb529e23798b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f7dd91957a8e7e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-12/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-19 11:03
Modified
2024-11-21 00:04
Severity ?
Summary
SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450"
},
{
"lang": "es",
"value": "** DISPUTADA ** Vulnerabilidad de inyecci\u00f3n de SQL en server_privileges.php en phpMyAdmin 2.7.0 permite a atacantes remotos ejecutar \u00f3rdenes SQL de su elecci\u00f3n mediante los par\u00e1metros (1)dbname y (2) checkprivs.\r\n\r\nNOTA: el fabricante y una tercera parte disputan esta cuesti\u00f3n, diciendo que la tarea principal del programa es soportar la ejecuci\u00f3n de consultas por usuarios autenticados, y no existe ning\u00fan escenario de ataque externo sin una configuraci\u00f3n con inicio autom\u00e1tico de sesi\u00f3n. Por lo tanto, es probable que esta cuesti\u00f3n sea rechazada."
}
],
"id": "CVE-2005-4349",
"lastModified": "2024-11-21T00:04:02.880",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-19T11:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=113486637512821\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18113"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/270"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/419829/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/419832/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2005/2995"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=113486637512821\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/18113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/419829/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/419832/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2005/2995"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information."
},
{
"lang": "es",
"value": "Vulnerabilidad XSS en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a trav\u00e9s de una petici\u00f3n SQL que no est\u00e1 manejada adecuadamente cuando se muestra la informaci\u00f3n de la fila."
}
],
"id": "CVE-2013-4995",
"lastModified": "2024-11-21T01:56:51.700",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-31T13:20:08.500",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61510"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un atacante puede determinar la localizaci\u00f3n del host phpMyAdmin a trav\u00e9s del archivo url.php. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6627",
"lastModified": "2024-11-21T02:56:30.413",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:35.987",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92494"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92494"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-50"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-08-24 19:29
Modified
2024-11-21 03:51
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/105168 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.securitytracker.com/id/1041548 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 | Patch, Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-5/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/105168 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041548 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-5/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "76F2056A-4EBA-4380-9CEA-1EB18359929A",
"versionEndExcluding": "4.8.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en versiones anteriores a la 4.8.3 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un archivo manipulado para manipular un usuario autenticado que cargue ese archivo mediante la caracter\u00edstica de importaci\u00f3n."
}
],
"id": "CVE-2018-15605",
"lastModified": "2024-11-21T03:51:09.553",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-24T19:29:02.067",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/105168"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041548"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/105168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041548"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-01-19 16:30
Modified
2024-11-21 00:58
Severity ?
Summary
libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 creates a temporary directory with 0777 permissions, which has unknown impact and attack vectors."
},
{
"lang": "es",
"value": "libraries/File.class.php en phpMyAdmin v2.11.x anterior a v2.11.10 crea un directorio temporal con permisos 0777, lo que tiene un impacto y vectores de ataque desconocidos."
}
],
"id": "CVE-2008-7251",
"lastModified": "2024-11-21T00:58:39.457",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-01-19T16:30:00.587",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39503"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/37826"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11536\u0026r2=11535\u0026pathrev=11536"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11536"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39503"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/37826"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg[\u0027Servers\u0027] variables."
}
],
"id": "CVE-2004-2632",
"lastModified": "2024-11-20T23:53:51.053",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11974"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/alerts/2004/Jun/1010614.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7315"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16555"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0444.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2004-06/0473.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://eagle.kecapi.com/sec/fd/phpMyAdmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/alerts/2004/Jun/1010614.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200407-22.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.osvdb.org/7315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/10629"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16555"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-12 10:17
Modified
2024-11-21 00:37
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.11.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo scripts/setup.php en phpMyAdmin versi\u00f3n 2.11.1, cuando es accedida mediante un navegador que no codifica las peticiones de URL, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de la cadena de consulta."
}
],
"id": "CVE-2007-5386",
"lastModified": "2024-11-21T00:37:46.920",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-10-12T10:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/37678"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27173"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27506"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27595"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/482339/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26020"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3469"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37077"
},
{
"source": "cve@mitre.org",
"url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/37678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10748\u0026r2=10747\u0026pathrev=10748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/?view=log"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27173"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27595"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071009a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/482339/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26020"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3469"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37077"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://sourceforge.net/tracker/index.php?func=detail\u0026aid=1810629\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94530 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-64 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94530 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-64 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema XSS en phpMyAdmin debido a una correcci\u00f3n incorrecta para la CVE-2016-2559 en PMASA-2016-10. Este problema se resuelve utilizando una copia de un hash para evitar una condici\u00f3n de carrera. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9856",
"lastModified": "2024-11-21T03:01:53.583",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:55.100",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-21 23:55
Modified
2024-11-21 01:43
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en phpMyAdmin v3.5.x anterior a v3.5.2.2 permite a usuarios remotos autenticados inyectar c\u00f3digo arbitrario web o HTML a trav\u00e9s de una (Operations Table) (1) (TRUNCATE) o (2) (DROP link) para un nombre de tabla manipulado, (3) la ventaja emergente Add Trigger con una p\u00e1gina Triggers que referencia a nombres de tabla manipulados, (4) un intento no v\u00e1lido de creaci\u00f3n para una nombre de tabla manipulado, (5) datos manipulados en una tabla, o (6) un nombre de una etiqueta (tooltip) durante la visualizaci\u00f3n de datos GIS, un problema distinto de CVE-2012-4345."
}
],
"id": "CVE-2012-4579",
"lastModified": "2024-11-21T01:43:10.790",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-21T23:55:01.747",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-04-16 15:12
Modified
2024-11-21 01:02
Severity ?
Summary
Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.0.0 | |
| phpmyadmin | phpmyadmin | 3.0.1 | |
| phpmyadmin | phpmyadmin | 3.1.0 | |
| phpmyadmin | phpmyadmin | 3.1.0.0 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.1 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.2 | |
| phpmyadmin | phpmyadmin | 3.1.3 | |
| phpmyadmin | phpmyadmin | 3.1.3 | |
| phpmyadmin | phpmyadmin | 3.1.3 | |
| phpmyadmin | phpmyadmin | 3.1.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1:*:*:*:*:*:*",
"matchCriteriaId": "F0BD3CDF-31C5-4B8A-8314-A5F0F9D28AA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de c\u00f3digo est\u00e1tico en la funci\u00f3n getConfigFile en setup/lib/ConfigFile.class.php en phpMyAdmin v3.x antes de v3.1.3.2 permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n en ficheros de configuraci\u00f3n."
}
],
"id": "CVE-2009-1285",
"lastModified": "2024-11-21T01:02:06.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-04-16T15:12:57.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34727"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34741"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/34526"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2009/1045"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248\u0026r2=12301\u0026pathrev=12342"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34727"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/34526"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2009/1045"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-03-10 17:44
Modified
2024-11-21 06:39
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B302E7A-25F2-41B5-BF4D-85CC6C6743CC",
"versionEndIncluding": "5.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section."
},
{
"lang": "es",
"value": "PhpMyAdmin versiones 5.1.1 y anteriores, permiten a un atacante recuperar informaci\u00f3n potencialmente confidencial creando peticiones no v\u00e1lidas. Esto afecta al par\u00e1metro lang, al par\u00e1metro pma_ y a la cookie section"
}
],
"id": "CVE-2022-0813",
"lastModified": "2024-11-21T06:39:26.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "cve-coordination@incibe.es",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-03-10T17:44:57.003",
"references": [
{
"source": "cve-coordination@incibe.es",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "cve-coordination@incibe.es",
"tags": [
"Third Party Advisory"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information"
},
{
"source": "cve-coordination@incibe.es",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/phpmyadmin-exposure-sensitive-information"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/news/2022/2/11/phpmyadmin-4910-and-513-are-released/"
}
],
"sourceIdentifier": "cve-coordination@incibe.es",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "cve-coordination@incibe.es",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-03-04 23:44
Modified
2024-11-21 00:43
Severity ?
Summary
phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0.0 | |
| phpmyadmin | phpmyadmin | 2.11.1 | |
| phpmyadmin | phpmyadmin | 2.11.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.0 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3 | |
| phpmyadmin | phpmyadmin | 2.11.3 | |
| phpmyadmin | phpmyadmin | 2.11.3.0 | |
| phpmyadmin | phpmyadmin | 2.11.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B22BF32-DC77-4EB1-9DD8-0B2189039F0C",
"versionEndIncluding": "2.11.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies."
},
{
"lang": "es",
"value": "phpMyAdmin anterior a la v2.11.5, accesos a $_REQUEST para obtener alg\u00fan par\u00e1metro en vez de usar $_GET y $_POST, puede permitir a atacantes remotos del mismo dominio sobrescribir variables, inyectar c\u00f3digo SQL y realizar ataques de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) usando cookies manipuladas."
}
],
"id": "CVE-2008-1149",
"lastModified": "2024-11-21T00:43:47.697",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-03-04T23:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29143"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29200"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29287"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/28068"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/0731"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/0758"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40968"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29143"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29200"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29287"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200803-15.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/28068"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/0731"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/0758"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40968"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00069.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00100.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
},
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-03-01 11:59
Modified
2024-11-21 02:48
Severity ?
Summary
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 | |
| phpmyadmin | phpmyadmin | 4.5.3.1 | |
| phpmyadmin | phpmyadmin | 4.5.4 | |
| phpmyadmin | phpmyadmin | 4.5.4.1 | |
| phpmyadmin | phpmyadmin | 4.5.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F90283AD-A616-403C-BE69-BCB2FD58A2CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "043B846F-4CDF-402A-B14A-B4949B1D403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C7B52D3D-C5F0-4793-AFA3-C518400DB71C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5B476503-1A1B-408B-9E66-1E4940090AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7123D6E6-3AE7-4413-AD6E-0D68D44C6F94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "05A2EBE2-E55C-45DF-A74C-1B5F7E6EEC25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "909DFCAB-A44B-4EB8-B54D-066699AE760B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate."
},
{
"lang": "es",
"value": "La funci\u00f3n checkHTTP en libraries/Config.class.php en phpMyAdmin 4.5.x en versiones anteriores a 4.5.5.1 no verifica certificados X.509 desde los servidores SSL de api.github.com, lo que permite a atacantes man-in-the-middle suplantar estos servidores y obtener informaci\u00f3n sensible a trav\u00e9s de un certificado manipulado."
}
],
"id": "CVE-2016-2562",
"lastModified": "2024-11-21T02:48:42.253",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-03-01T11:59:04.643",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-13/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20bfc5aca0ff976"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-13/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-11-22 21:15
Modified
2024-11-21 04:33
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| opensuse | leap | 15.0 | |
| opensuse | leap | 15.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A48DCA8C-1CE7-4518-B9EC-5D368AC1057F",
"versionEndExcluding": "4.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "76977883-4C5F-4911-93AC-88877112D371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature."
},
{
"lang": "es",
"value": "Se detect\u00f3 un problema en phpMyAdmin versiones anteriores a 4.9.2. Se puede utilizar un nombre de base de datos/tabla dise\u00f1ado para desencadenar un ataque de inyecci\u00f3n SQL por medio de la funcionalidad designer."
}
],
"id": "CVE-2019-18622",
"lastModified": "2024-11-21T04:33:23.143",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-11-22T21:15:10.943",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202003-39"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202003-39"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-05-26 15:59
Modified
2024-11-21 02:30
Severity ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "B6360AD1-B295-4123-A6AC-99B13FA12C1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CA9A5D9E-EF89-4F0B-8DA2-B54DAB5616BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AEE79B8B-2B53-44A9-B5A2-233A43149448",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AA505-40A6-4767-A848-3B00EA8EDD7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "347983D5-CB40-44C9-8C68-10A8417F4BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "16C9023A-2E9A-4DDA-84A8-D6E2A4F1019F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "564261EC-AEA3-4BDD-9E7D-56B29628D16F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2154D6EC-C492-4035-B5E6-9A5BAB2F2164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "819ECCB5-C0D7-47D0-8479-2C36734F47B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3499F9A7-3F4E-4AD3-94FB-242FD135B851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "53CFCBBC-E941-4167-A474-7C88F6C489AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "CE374D7A-90E3-42A1-A02A-88B03AB70605",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2088A96D-C4C6-4FA9-8594-3DAA81D48443",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F02404-0D50-4222-B24D-6D5E34A6E60F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "254D4A65-99B4-4594-8929-1D0481DB170B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D679D05B-58B9-4089-B002-F60646D6283F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.13:*:*:*:*:*:*:*",
"matchCriteriaId": "588D87F7-2F0E-4912-B81A-7A7C6642B1AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de CSRF en el proceso de montaje en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para solicitudes que modifican el fichero de configuraci\u00f3n."
}
],
"id": "CVE-2015-3902",
"lastModified": "2024-11-21T02:30:03.283",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-05-26T15:59:10.370",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/74657"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1032404"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/74657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1032404"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | leap | 42.1 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 | |
| fedoraproject | fedora | 22 | |
| fedoraproject | fedora | 23 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message."
},
{
"lang": "es",
"value": "phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n manipulada a (1) libraries/phpseclib/Crypt/AES.php o (2) libraries/phpseclib/Crypt/Rijndael.php, lo cual revela la ruta completa en un mensaje de error."
}
],
"id": "CVE-2016-2042",
"lastModified": "2024-11-21T02:47:40.450",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:05.470",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5a3de108f26e4b0dddadddbe8ccdb1dd5526771f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario puede manipular especialmente un enlace simb\u00f3lico en disco, a un archivo que phpMyAdmin se le permite leer pero al usuario no, lo que phpMyAdmin luego expondr\u00e1 al usuario. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6613",
"lastModified": "2024-11-21T02:56:26.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:19.580",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94115"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-36"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-36"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-5 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-5 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 | |
| phpmyadmin | phpmyadmin | 4.6.5 | |
| phpmyadmin | phpmyadmin | 4.6.5.1 | |
| phpmyadmin | phpmyadmin | 4.6.5.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "33130418-95AC-41D2-B8B0-A107C9CABCFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22A5550C-91AC-41C3-AADF-1A7C02089E66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F7A5E347-7A9D-4FAF-BDD2-314FA0A01821",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness was discovered where an attacker can inject arbitrary values in to the browser cookies. This is a re-issue of an incomplete fix from PMASA-2016-18."
},
{
"lang": "es",
"value": "Se detect\u00f3 una debilidad en la que un atacante puede inyectar valores arbitrarios en las cookies del navegador. Esta es una reedici\u00f3n de una soluci\u00f3n incompleta de PMASA-2016-18."
}
],
"id": "CVE-2017-1000016",
"lastModified": "2024-11-21T03:03:58.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.437",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-5"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-20 11:12
Modified
2024-11-21 02:11
Severity ?
Summary
server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | opensuse | 12.3 | |
| opensuse | opensuse | 13.1 | |
| phpmyadmin | phpmyadmin | 4.1.0 | |
| phpmyadmin | phpmyadmin | 4.1.1 | |
| phpmyadmin | phpmyadmin | 4.1.2 | |
| phpmyadmin | phpmyadmin | 4.1.3 | |
| phpmyadmin | phpmyadmin | 4.1.4 | |
| phpmyadmin | phpmyadmin | 4.1.5 | |
| phpmyadmin | phpmyadmin | 4.1.6 | |
| phpmyadmin | phpmyadmin | 4.1.7 | |
| phpmyadmin | phpmyadmin | 4.1.8 | |
| phpmyadmin | phpmyadmin | 4.1.9 | |
| phpmyadmin | phpmyadmin | 4.1.10 | |
| phpmyadmin | phpmyadmin | 4.1.11 | |
| phpmyadmin | phpmyadmin | 4.1.12 | |
| phpmyadmin | phpmyadmin | 4.1.13 | |
| phpmyadmin | phpmyadmin | 4.1.14 | |
| phpmyadmin | phpmyadmin | 4.1.14.1 | |
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 | |
| phpmyadmin | phpmyadmin | 4.2.4 | |
| phpmyadmin | phpmyadmin | 4.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "server_user_groups.php in phpMyAdmin 4.1.x before 4.1.14.2 and 4.2.x before 4.2.6 allows remote authenticated users to bypass intended access restrictions and read the MySQL user list via a viewUsers request."
},
{
"lang": "es",
"value": "server_user_groups.php en phpMyAdmin 4.1.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.6 permite a usuarios remotos autenticados evadir las restricciones de acceso y leer la lista de usuarios de MySQL a trav\u00e9s de una solicitud viewUsers."
}
],
"id": "CVE-2014-4987",
"lastModified": "2024-11-21T02:11:13.657",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-07-20T11:12:51.290",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68804"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68804"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/395265e9937beb21134626c01a21f44b28e712e5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-08 11:55
Modified
2024-11-21 02:14
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la implementaci\u00f3n micro history en phpMyAdmin 4.0.x anterior a 4.0.10.3, 4.1.x anterior a 4.1.14.4, y 4.2.x anterior a 4.2.8.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios , y como consecuencia realizar un ataque de CSRF para crear una cuenta root, a trav\u00e9s de una URL manipulada, relacionado con js/ajax.js."
}
],
"id": "CVE-2014-6300",
"lastModified": "2024-11-21T02:14:07.877",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-11-08T11:55:02.927",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/69790"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/69790"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/95720 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-1 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95720 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-1 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.18:*:*:*:*:*:*:*",
"matchCriteriaId": "B90D111A-A076-4936-BA7F-E2C3ACE44B8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.9:*:*:*:*:*:*:*",
"matchCriteriaId": "09D97993-070A-4D32-B560-38AF28C87A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "33130418-95AC-41D2-B8B0-A107C9CABCFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness"
},
{
"lang": "es",
"value": "phpMyAdmin en las versiones 4,0, 4,4, y 4,6 es vulnerable a una debilidad de redireccionamiento abierta."
}
],
"id": "CVE-2017-1000013",
"lastModified": "2024-11-21T03:03:58.087",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95720"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-12-08 16:00
Modified
2024-11-21 01:21
Severity ?
Summary
error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.3.8.1 | |
| phpmyadmin | phpmyadmin | 3.3.9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing \"@\" characters, as demonstrated using \"[a@url@page]\"."
},
{
"lang": "es",
"value": "El archivo error.php en PhpMyAdmin versi\u00f3n 3.3.8.1, y otras versiones anteriores a 3.4.0-beta1, permite a los atacantes remotos conducir ataques de tipo cross-site scripting (XSS), por medio de una etiqueta BBcode creada que contiene caracteres \"@\", como es demostrado usando \"[a@url@page] \"."
}
],
"id": "CVE-2010-4480",
"lastModified": "2024-11-21T01:21:02.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-12-08T16:00:02.960",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42485"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42725"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/15699"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/45633"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3133"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42485"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/15699"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/45633"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3133"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. When the arg_separator is different from its default \u0026 value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Cuando el arg_separator es diferente de su valor predeterminado, el token CSRF no s\u00e9 elimin\u00f3 correctamente de la URL de retorno de la acci\u00f3n de importaci\u00f3n de preferencias. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9866",
"lastModified": "2024-11-21T03:01:55.130",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:08.853",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94536"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94536"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-71"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2001-06-27 04:00
Modified
2024-11-20 23:35
Severity ?
Summary
Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/2642 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/2642 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC697214-63D7-4833-A3ED-F9FB9E3E4CE4",
"versionEndIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script."
}
],
"id": "CVE-2001-0478",
"lastModified": "2024-11-20T23:35:27.967",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2001-06-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/2642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-04/0396.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/2642"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-21 23:55
Modified
2024-11-21 01:42
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.1 | |
| phpmyadmin | phpmyadmin | 3.4.8.0 | |
| phpmyadmin | phpmyadmin | 3.4.9.0 | |
| phpmyadmin | phpmyadmin | 3.4.10.0 | |
| phpmyadmin | phpmyadmin | 3.4.10.1 | |
| phpmyadmin | phpmyadmin | 3.4.10.2 | |
| phpmyadmin | phpmyadmin | 3.4.11 | |
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C36E012-A028-4A47-9EAB-553D18F5E053",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C774C482-4EE2-47DE-BCC4-35020E02A9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "10F44BD9-A868-420B-9B9F-9CC4809A9C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "706127A4-C6E2-4A6C-81EC-3B890E677273",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4DB17D6D-14FD-4CEB-96C7-20FCB823D495",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "82EB3D89-67EB-482B-B254-0AB658610E3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en la p\u00e1gina de (Database Structure) de datos en phpMyAdmin v3.4.x anterior a v3.4.11.1 y v3.5.x anterior a v3.5.2.2 permite a usuarios remotos autenticados inyectar c\u00f3digo arbitrario web o HTML a trav\u00e9s de (1) un nombre de tabla manipulado durante la creaci\u00f3n de una tabla, o un (2) enlace vac\u00edo o (3) (Dropt link) para un nombre de tabla manipulado."
}
],
"id": "CVE-2012-4345",
"lastModified": "2024-11-21T01:42:43.147",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-21T23:55:01.700",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:136"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15513071"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it\u0027s valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Algunos datos se pasan a la funci\u00f3n de PHP unserialize() sin verificar que son datos serializados v\u00e1lidos. La no serializaci\u00f3n puede resultar en la ejecuci\u00f3n de c\u00f3digo debido a la interacci\u00f3n con la instancia de objetos y carga autom\u00e1tica. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6620",
"lastModified": "2024-11-21T02:56:28.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:28.487",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95055"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-43"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95055"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-43"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-09-30 16:13
Modified
2024-11-21 00:51
Severity ?
Summary
The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DD358C91-F735-4A7C-B71E-C87AF82A4CD6",
"versionEndIncluding": "2.11.9.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F14B08F-6583-4686-B534-616D42B7D90B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "D4CD5425-79A4-4506-8BDA-299449EB51DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F754BBA9-765F-4BDE-9AF3-3DA4300B17C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "7A136E97-05EA-4ADF-82F5-E2D0C7737D6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "53AE58C1-CB8C-415F-BF58-BD356D3AC000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "704C4359-A80E-456F-AA69-D188E4DFDBA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5DAB33AF-D8A9-444F-AC69-FACCFA0EEB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "33423F75-0F5A-49F6-BF70-66DC2CE39E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0611660F-F060-453C-8BE2-1599FE3FF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD9FD0D-2786-43BB-938B-A45D9B60E08E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3CE1C3-59FF-457F-8579-996CA60CF6AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F2B3C2-0EDB-48D3-92BC-B1CA0E41F230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B64201-5B5B-4D22-B341-C601DC54BFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3130CFD-FF94-48D2-BF9A-D7FDD3CD6A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8682FAF3-98E3-485C-89CB-C0358C4E2AB0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a \"\u003c/script\" sequence."
},
{
"lang": "es",
"value": "La funci\u00f3n PMA_escapeJsString de libraries/js_escape.lib.php de phpMyAdmin antes de v2.11.9.2, al usar Internet Explorer, permite a usuarios remotos evitar los mecanismos de protecci\u00f3n contra la ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) y llevar a cabo ataques XSS a trav\u00e9s de un byte NULL dentro de una sentencia \"\u003c/script\"."
}
],
"id": "CVE-2008-4326",
"lastModified": "2024-11-21T00:51:23.800",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-09-30T16:13:50.437",
"references": [
{
"source": "cve@mitre.org",
"url": "http://jvn.jp/en/jp/JVN54824688/index.html"
},
{
"source": "cve@mitre.org",
"url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/48511"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31974"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31992"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32954"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1675"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2008/09/22/2"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN54824688/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/48511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?r1=11514\u0026r2=11603\u0026pathrev=11603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/js_escape.lib.php?view=log\u0026pathrev=11603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31992"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32954"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080924-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1675"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2008/09/22/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2657"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-01-22 02:15
Modified
2024-11-21 06:49
Severity ?
Summary
An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "45AFD905-B58E-42E9-9682-3CB2E644DCFF",
"versionEndExcluding": "5.1.2",
"versionStartIncluding": "5.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection."
},
{
"lang": "es",
"value": "Se ha detectado un problema en phpMyAdmin versiones 5.1 anteriores a 5.1.2. Un atacante puede inyectar c\u00f3digo malicioso en aspectos del script de configuraci\u00f3n, lo que puede permitir una inyecci\u00f3n de tipo XSS o HTML"
}
],
"id": "CVE-2022-23808",
"lastModified": "2024-11-21T06:49:17.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-22T02:15:07.197",
"references": [
{
"source": "cve@mitre.org",
"url": "https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://infosecwriteups.com/exploit-cve-2022-23808-85041c6e5b97"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/202311-17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2022-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php."
},
{
"lang": "es",
"value": "phpMyAdmin 4.0.x anterior a 4.0.4.2, permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n inv\u00e1lida, que revela la ruta de instalaci\u00f3n en un mensaje de error. Relacionado con Error.class.php y Error_Handler.class.php."
}
],
"id": "CVE-2013-4999",
"lastModified": "2024-11-21T01:56:52.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-31T13:20:08.633",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-04-18 10:02
Modified
2024-11-21 00:09
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "23E30EDB-889A-4A35-A636-B12BC9079C47",
"versionEndIncluding": "2.8.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in sql.php in phpMyAdmin 2.7.0-pl1 allows remote attackers to inject arbitrary web script or HTML via the sql_query parameter."
}
],
"id": "CVE-2006-1803",
"lastModified": "2024-11-21T00:09:47.997",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-04-18T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/430902/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17487"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25796"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/19897"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/430902/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/431013/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17487"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1372"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25796"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en examples/openid.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permiten a atacantes remotos inyectar comandos de secuencias web o HTML arbitrarios a trav\u00e9s de vectores relacionados con un error de mensaje OpenID."
}
],
"id": "CVE-2016-5731",
"lastModified": "2024-11-21T02:54:54.697",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:21.253",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-04 14:33
Modified
2024-11-21 01:56
Severity ?
Summary
import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request."
},
{
"lang": "es",
"value": "import.php en phpMyAdmin v4.x anterior a v4.0.4.1 no restringe correctamente la capacidad de la entrada de datos a un formato de fichero espec\u00edfico, lo que permite a usuarios remotamente autenticados modificar el array global GLOBALS, y consecuentemente a trav\u00e9s de peticiones malformadas."
}
],
"id": "CVE-2013-4729",
"lastModified": "2024-11-21T01:56:10.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-04T14:33:41.687",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/012464268420e53a9cd81cbb4a43988d70393c36"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended."
}
],
"id": "CVE-2005-0653",
"lastModified": "2024-11-20T23:55:37.350",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=83792"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://bugs.gentoo.org/show_bug.cgi?id=83792"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200503-07.xml"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-03 04:00
Modified
2024-11-20 23:57
Severity ?
Summary
The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script."
}
],
"id": "CVE-2005-1392",
"lastModified": "2024-11-20T23:57:14.947",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-03T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=88831"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200504-30.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/16053"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/0436"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=88831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200504-30.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/16053"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/0436"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-10-16 16:30
Modified
2024-11-21 01:07
Severity ?
Summary
SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "5899F407-1D31-452A-954C-966895ED7D48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0-beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFDEFBE-E512-4B0C-BBEC-8FCA29228DDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "CFAD5F7D-AA93-46B7-996B-B0761143B334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FBEBBAAF-BAA7-40E9-A0FF-F8618A3ED2D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:1:*:*:*:*:*:*",
"matchCriteriaId": "F0BD3CDF-31C5-4B8A-8314-A5F0F9D28AA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0-beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "1DD4EF8B-EA44-46F2-9C28-1D9D1D8BA2CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "426ED65D-8B72-4106-A75E-1CB74106DD46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified interface parameters."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en la funcionalidad generador de esquema PDF en phpMyAdmin v2.11.x anterior a v2.11.9.6 y v3.x anterior a v3.2.2.1 permite a atacantes remotos ejecutar comandos SQL a su elecci\u00f3n a trav\u00e9s de par\u00e1metros de la interfaz no especificados."
}
],
"id": "CVE-2009-3697",
"lastModified": "2024-11-21T01:07:59.050",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2009-10-16T16:30:00.813",
"references": [
{
"source": "cve@mitre.org",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"source": "cve@mitre.org",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"source": "cve@mitre.org",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"source": "cve@mitre.org",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"source": "cve@mitre.org",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37016"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53741"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=288899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/2.11.9.6/phpMyAdmin-2.11.9.6-notes.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://dfn.dl.sourceforge.net/project/phpmyadmin/phpMyAdmin/3.2.2.1/phpMyAdmin-3.2.2.1-notes.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://freshmeat.net/projects/phpmyadmin/releases/306669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=125553728512853\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=oss-security\u0026m=125561979001460\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/37016"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/extensions/repository/view/phpmyadmin/4.5.0/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-015/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:274"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/36658"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2009/2899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=528769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00467.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00490.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences."
},
{
"lang": "es",
"value": "libraries/common.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 no utiliza un algoritmo de tiempo constante para comparar tokens CSRF, lo que hace que sea m\u00e1s f\u00e1cil para atacantes remotos eludir las restricciones destinadas al acceso mediante la medici\u00f3n de diferencias de tiempo."
}
],
"id": "CVE-2016-2041",
"lastModified": "2024-11-21T02:47:40.273",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:04.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ec0e88e37ef30a66eada1c072953f4ec385a3e49"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-05-03 04:08
Modified
2024-11-21 01:36
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.1 | |
| phpmyadmin | phpmyadmin | 3.4.8.0 | |
| phpmyadmin | phpmyadmin | 3.4.9.0 | |
| phpmyadmin | phpmyadmin | 3.4.10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DD8C3CAC-7CE6-4D13-9640-B924081D628E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C36E012-A028-4A47-9EAB-553D18F5E053",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C774C482-4EE2-47DE-BCC4-35020E02A9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "10F44BD9-A868-420B-9B9F-9CC4809A9C49",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad de replicaci\u00f3n de configuraci\u00f3n en js/replication.js en phpMyAdmin v3.4.x antes de v3.4.10.1, permite a los atacantes remotos asistidos por el usuario inyectar secuencias de comandos web o HTML a trav\u00e9s de un nombre de base de datos modificado."
}
],
"id": "CVE-2012-1190",
"lastModified": "2024-11-21T01:36:37.833",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-05-03T04:08:25.170",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52857"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75304"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52857"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75304"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. La caracter\u00edstica de transformaci\u00f3n permite a usuarios desencadenar una ataque de denegaci\u00f3n de servicio (DoS) contra el servidor. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6618",
"lastModified": "2024-11-21T02:56:27.677",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:25.830",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95047"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-41"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95047"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-41"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-16 11:02
Modified
2024-11-21 00:02
Severity ?
Summary
phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.2.0 | |
| phpmyadmin | phpmyadmin | 2.2.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.1_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.3_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl3 | |
| phpmyadmin | phpmyadmin | 2.6.4_pl4 | |
| phpmyadmin | phpmyadmin | 2.7.0_beta1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory."
},
{
"lang": "es",
"value": "phpMyAdmin 2.7.0-beta1 y anteriores permiten a atacantes remotos obtener la ruta completa del servidor mediante peticiones directas a varios scripts en el directorio de bibliotecas.\r\n\r\n"
}
],
"id": "CVE-2005-3622",
"lastModified": "2024-11-21T00:02:16.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-16T11:02:00.000",
"references": [
{
"source": "security@debian.org",
"url": "http://marc.info/?l=bugtraq\u0026m=113208319104035\u0026w=2"
},
{
"source": "security@debian.org",
"url": "http://securityreason.com/securityalert/185"
},
{
"source": "security@debian.org",
"url": "http://securitytracker.com/id?1015213"
},
{
"source": "security@debian.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fitsec.com/advisories/FS-05-02.txt"
},
{
"source": "security@debian.org",
"url": "http://www.osvdb.org/20911"
},
{
"source": "security@debian.org",
"url": "http://www.osvdb.org/20912"
},
{
"source": "security@debian.org",
"url": "http://www.osvdb.org/20913"
},
{
"source": "security@debian.org",
"url": "http://www.osvdb.org/20914"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=113208319104035\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015213"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fitsec.com/advisories/FS-05-02.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20911"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20912"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20913"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20914"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fedoraproject | fedora | 22 | |
| fedoraproject | fedora | 23 | |
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
},
{
"lang": "es",
"value": "libraries/sql-parser/autoload.php en analizador SQL en phpMyAdmin 4.5.x en versiones anteriores a 4.5.4 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n manipulada, lo cual revela la ruta completa en un mensaje de error."
}
],
"id": "CVE-2016-2044",
"lastModified": "2024-11-21T02:47:40.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:07.563",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c57d3cc7b97b5f32801032f7bb222297aa97dfea"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-10-03 01:55
Modified
2024-11-21 02:16
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.class.php and libraries/Util.class.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x anterior a 4.0.10.4, 4.1.x anterior a 4.1.14.5, y 4.2.x anterior a 4.2.9.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un valor ENUM manipulado que se maneja indebidamente durante la renderizaci\u00f3n de la p\u00e1gina de (1) b\u00fasqueda de tablas o (2) estructura de tablas, relacionado con libraries/TableSearch.class.php y libraries/Util.class.php."
}
],
"id": "CVE-2014-7217",
"lastModified": "2024-11-21T02:16:33.223",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-10-03T01:55:08.563",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/61777"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/70252"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-10/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/61777"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-11.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/70252"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/304fb2b645b36a39e03b954fdbd567173ebe6448"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c1a3f85fbd1a9569646e7cf1b791325ae82c7961"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*",
"matchCriteriaId": "C729D5D1-ED95-443A-9F53-5D7C2FD9B80C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value."
},
{
"lang": "es",
"value": "libraries/session.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 no genera adecuadamente valores de token CSRF, lo que permite a atacantes remotos eludir las restricciones destinadas al acceso mediante la predicci\u00f3n de un valor."
}
],
"id": "CVE-2016-2039",
"lastModified": "2024-11-21T02:47:39.943",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:02.140",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cb7748ac9cffcd1cd0f3081499cd4aafa9d1065e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f20970d32c3dfdf82aef7b6c244da1f769043813"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-11-23 20:46
Modified
2024-11-21 00:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "618A507F-2EDD-48D9-B737-8110CE3FCC36",
"versionEndIncluding": "2.11.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5DAB33AF-D8A9-444F-AC69-FACCFA0EEB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F2B3C2-0EDB-48D3-92BC-B1CA0E41F230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados(XSS) en el fichero libraries/auth/cookie.auth.lib.php de phpMyAdmin, en versiones previas a la 2.11.2.2. Cuando los inicios de sesi\u00f3n son autenticados con la cookie auth_type, la vulnerabilidad permite que atacantes remotos inyecten, a su elecci\u00f3n, c\u00f3digos web o HTML en index.php a trav\u00e9s del par\u00e1metro convcharset. Una vulnerabilidad distinta a CVE-2005-0992."
}
],
"id": "CVE-2007-6100",
"lastModified": "2024-11-21T00:39:21.583",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-11-23T20:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27748"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29323"
},
{
"source": "cve@mitre.org",
"url": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/26513"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3943"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38601"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29323"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/26513"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38601"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-30 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file's line count via a crafted parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC60DE84-575A-4031-8B78-AD67C60595AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58D3F904-8C3C-46A5-A7A6-8EFA49648687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to obtain potentially sensitive information about a file\u0027s line count via a crafted parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en libraries/error_report.lib.php en la caracteristica de informe de errores en phpMyAdmin 4.1.x anterior a 4.1.14.7 y 4.2.x anterior a 4.2.12 permite a usuarios remotos autenticados obtener informaci\u00f3n potencialmente sensible sobre el recuento de l\u00edneas de un fichero a trav\u00e9s de un par\u00e1metro manipulado."
}
],
"id": "CVE-2014-8961",
"lastModified": "2024-11-21T02:20:00.920",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-30T11:59:03.603",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71245"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-16.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b99b6b6672ff2419f05b05740c80c7a23c1da994"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin que implicaba una aplicaci\u00f3n incorrecta de las reglas de autenticaci\u00f3n basadas en IP. Cuando phpMyAdmin es utilizado con IPv6 en un entorno de servidor proxy, y el servidor proxy se encuentra en el rango permitido pero el ordenador atacante no est\u00e1 permitido, esta vulnerabilidad puede permitir al ordenador atacante conectar a pesar de las reglas IP. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6624",
"lastModified": "2024-11-21T02:56:29.927",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:31.927",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92489"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-47"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92489"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-47"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/92493 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-52 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92493 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-52 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving the $cfg[\u0027ArbitraryServerRegexp\u0027] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin que implica la directiva de configuraci\u00f3n $cfg[\u0027ArbitraryServerRegexp\u0027]. Un atacante podr\u00eda reutilizar ciertos valores de cookie en una forma de eludir los servidores definidos por ArbitraryServerRegexp. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6629",
"lastModified": "2024-11-21T02:56:30.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:38.550",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92493"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-52"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-52"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-07-02 17:14
Modified
2024-11-21 00:48
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.10.0 | |
| phpmyadmin | phpmyadmin | 2.10.0.1 | |
| phpmyadmin | phpmyadmin | 2.10.0.2 | |
| phpmyadmin | phpmyadmin | 2.10.1 | |
| phpmyadmin | phpmyadmin | 2.10.2 | |
| phpmyadmin | phpmyadmin | 2.10.3 | |
| phpmyadmin | phpmyadmin | 2.10.3rc1 | |
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0beta1 | |
| phpmyadmin | phpmyadmin | 2.11.0rc1 | |
| phpmyadmin | phpmyadmin | 2.11.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.1rc1 | |
| phpmyadmin | phpmyadmin | 2.11.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3 | |
| phpmyadmin | phpmyadmin | 2.11.3rc1 | |
| phpmyadmin | phpmyadmin | 2.11.4 | |
| phpmyadmin | phpmyadmin | 2.11.4rc1 | |
| phpmyadmin | phpmyadmin | 2.11.5 | |
| phpmyadmin | phpmyadmin | 2.11.5.1 | |
| phpmyadmin | phpmyadmin | 2.11.5.2 | |
| phpmyadmin | phpmyadmin | 2.11.5rc1 | |
| phpmyadmin | phpmyadmin | 2.11.6 | |
| phpmyadmin | phpmyadmin | 2.11.6rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin antes de 2.11.7, cuando register_globals est\u00e1 habilitado y .htaccess support est\u00e1 deshabilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante vectores no especificados que involucran secuencias de comandos en libraries/."
}
],
"id": "CVE-2008-2960",
"lastModified": "2024-11-21T00:48:06.697",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-07-02T17:14:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30813"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/30816"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2008/07/16/11"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/1904/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/30816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2008/07/16/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/1904/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43320"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-20 11:12
Modified
2024-11-21 02:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5CA497-47A6-4A42-A720-CCB2AD82B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la funci\u00f3n PMA_TRI_getRowForList en libraries/rte/rte_list.lib.php en phpMyAdmin 4.0.x anterior a 4.0.10.1, 4.1.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de disparador (trigger) manipulado que se maneja indebidamente en la p\u00e1gina de disparadores (triggers) de la base de datos."
}
],
"id": "CVE-2014-4955",
"lastModified": "2024-11-21T02:11:10.213",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-07-20T11:12:51.197",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68799"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68799"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/10014d4dc596b9e3a491bf04f3e708cf1887d5e1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-05 01:59
Modified
2024-11-21 02:53
Severity ?
Summary
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | opensuse | 13.1 | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "243F912A-3C8F-4187-A259-427CAAB45F81",
"versionEndIncluding": "4.6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs."
},
{
"lang": "es",
"value": "phpMyAdmin en versiones anteriores a 4.6.2 emplaza tokens en cadenas de consulta y no gestiona su eliminaci\u00f3n antes de la navegaci\u00f3n externa, lo que permite a atacantes remotos obtener informaci\u00f3n sensible leyendo (1) peticiones HTTP o (2) los registros del servidor."
}
],
"id": "CVE-2016-5097",
"lastModified": "2024-11-21T02:53:37.333",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-05T01:59:05.673",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1035978"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1035978"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-14"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2001-07-31 04:00
Modified
2024-11-20 23:36
Severity ?
Summary
phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.0 | |
| phpmyadmin | phpmyadmin | 2.0.1 | |
| phpmyadmin | phpmyadmin | 2.0.2 | |
| phpmyadmin | phpmyadmin | 2.0.3 | |
| phpmyadmin | phpmyadmin | 2.0.4 | |
| phpmyadmin | phpmyadmin | 2.0.5 | |
| phpmyadmin | phpmyadmin | 2.1 | |
| phpmyadmin | phpmyadmin | 2.1.1 | |
| phpmyadmin | phpmyadmin | 2.1.2 | |
| phpmyadmin | phpmyadmin | 2.2_pre1 | |
| phpmyadmin | phpmyadmin | 2.2_rc1 | |
| phpmyadmin | phpmyadmin | 2.2_rc2 | |
| phpmyadmin | phpmyadmin | 2.2_rc3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.2.0rc3 and earlier allows remote attackers to execute arbitrary commands by inserting them into (1) the strCopyTableOK argument in tbl_copy.php, or (2) the strRenameTableOK argument in tbl_rename.php."
}
],
"id": "CVE-2001-1060",
"lastModified": "2024-11-20T23:36:46.617",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2001-07-31T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/200596"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/3121"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://freshmeat.net/redir/phpmyadmin/8001/url_changelog/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/200596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/3121"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-12-26 22:59
Modified
2024-11-21 02:38
Severity ?
Summary
libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
},
{
"lang": "es",
"value": "libraries/config/messages.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.12, 4.4.x en versiones anteriores a 4.4.15.2 y 4.5.x en versiones anteriores a 4.5.3.1 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n manipulada, lo que revela la ruta completa en un mensaje de error."
}
],
"id": "CVE-2015-8669",
"lastModified": "2024-11-21T02:38:56.207",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2015-12-26T22:59:01.240",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1034806"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-6/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1034806"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c4d649325b25139d7c097e56e2e46cc7187fae45"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-6/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-05 01:59
Modified
2024-11-21 02:53
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| opensuse | opensuse | 13.1 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before 4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary web script or HTML via special characters that are mishandled during double URL decoding."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.6 y 4.6.x en versiones anteriores a 4.6.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de caracteres especiales que no son manejados adecuadamente durante la doble decodificaci\u00f3n URL."
}
],
"id": "CVE-2016-5099",
"lastModified": "2024-11-21T02:53:37.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-05T01:59:07.613",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/90877"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1035979"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/90877"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1035979"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/b061096abd992801fbbd805ef6ff74e627528780"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-16"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-06-25 11:19
Modified
2024-11-21 02:10
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 | |
| phpmyadmin | phpmyadmin | 4.1.0 | |
| phpmyadmin | phpmyadmin | 4.1.1 | |
| phpmyadmin | phpmyadmin | 4.1.2 | |
| phpmyadmin | phpmyadmin | 4.1.3 | |
| phpmyadmin | phpmyadmin | 4.1.4 | |
| phpmyadmin | phpmyadmin | 4.1.5 | |
| phpmyadmin | phpmyadmin | 4.1.6 | |
| phpmyadmin | phpmyadmin | 4.1.7 | |
| phpmyadmin | phpmyadmin | 4.1.8 | |
| phpmyadmin | phpmyadmin | 4.1.9 | |
| phpmyadmin | phpmyadmin | 4.1.10 | |
| phpmyadmin | phpmyadmin | 4.1.11 | |
| phpmyadmin | phpmyadmin | 4.1.12 | |
| phpmyadmin | phpmyadmin | 4.1.13 | |
| phpmyadmin | phpmyadmin | 4.1.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.1.x anterior a 4.1.14.1 y 4.2.x anterior a 4.2.4 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de tabla manipulado que no se maneja debidamente despu\u00e9s de una acci\u00f3n de (1) esconder o (2) no esconder."
}
],
"id": "CVE-2014-4349",
"lastModified": "2024-11-21T02:10:01.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-06-25T11:19:22.573",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68205"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://phpmyadmin.net/home_page/security/PMASA-2014-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68205"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4f754c937f9e2c0beadff5b2e38215dde1d6a79"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/daa98d0c7ed24b529dc5df0d5905873acd0b00be"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-11-01 19:55
Modified
2024-11-21 01:31
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de comandos en sitios cruzados(XSS) en la interfaz de configuraci\u00f3n de phpMyAdmin v3.4.x antes de la versi\u00f3n v3.4.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un valor metido a mano."
}
],
"id": "CVE-2011-4064",
"lastModified": "2024-11-21T01:31:47.027",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-11-01T19:55:01.933",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/46874"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1026199"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/50175"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/46874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1026199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-16.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/50175"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94530 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-64 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94530 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-64 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. XSS es posible debido a una debilidad en una expresi\u00f3n regular utilizada en alg\u00fan procesamiento JavaScript. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9857",
"lastModified": "2024-11-21T03:01:53.743",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:56.243",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94530"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-64"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-09-18 15:04
Modified
2024-11-21 00:50
Severity ?
Summary
libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D221D53F-B6ED-4AA6-BF41-B72E9BEA513A",
"versionEndIncluding": "2.11.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/database_interface.lib.php in phpMyAdmin before 2.11.9.1 allows remote authenticated users to execute arbitrary code via a request to server_databases.php with a sort_by parameter containing PHP sequences, which are processed by create_function."
},
{
"lang": "es",
"value": "libraries/database_interface.lib.php en phpMyAdmin anterior a 2.11.9.1, permite a usuarios autenticados en remoto ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una solicitud a server_databases.php con un par\u00e1metro sort_by que contenga secuencias PHP que son procesadas por create_function."
}
],
"id": "CVE-2008-4096",
"lastModified": "2024-11-21T00:50:53.340",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-09-18T15:04:27.327",
"references": [
{
"source": "cve@mitre.org",
"url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/48196"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31884"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31918"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32034"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "cve@mitre.org",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/31188"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2585"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2619"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://fd.the-wildcat.de/pma_e36a091q11.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/48196"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31884"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31918"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200903-32.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-20080916-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.nabble.com/phpMyAdmin-2.11.9.1-is-released-td19497113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.openwall.com/lists/oss-security/2008/09/15/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2008/09/16/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/31188"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2585"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2619"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=462430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01137.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01155.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01228.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01290.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-07-06 20:05
Modified
2024-11-21 00:13
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0611660F-F060-453C-8BE2-1599FE3FF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3CE1C3-59FF-457F-8579-996CA60CF6AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the table parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin en versiones anteriores a 2.8.2, que permite a los atacantes remotos inyectar arbitrariamente una secuencia de comandos web o HTML a trav\u00e9s del par\u00e1metro table."
}
],
"evaluatorSolution": "Upgrade to 2.8.2",
"id": "CVE-2006-3388",
"lastModified": "2024-11-21T00:13:30.530",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-07-06T20:05:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20907"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitynews.ir/advisories/phpmyadmin281.txt"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1194"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/438870/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/18754"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/2622"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27493"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Nov/0010.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20907"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23086"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitynews.ir/advisories/phpmyadmin281.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1194"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/438870/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/18754"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/2622"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27493"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un nombre de tabla y/o de base de datos especialmente manipulada puede ser utilizado para desencadenar un ataque de inyecci\u00f3n SQL a trav\u00e9s de la funcionalidad de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.4) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6617",
"lastModified": "2024-11-21T02:56:27.523",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:24.673",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95044"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-40"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95044"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-40"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un nombre de base de datos especialmente manipulado podr\u00eda ser utilizado para ejecutar comandos PHP arbitrarios a trav\u00e9s de la funci\u00f3n de exportaci\u00f3n del array. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6609",
"lastModified": "2024-11-21T02:56:26.243",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:14.280",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94112"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-32"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user\u0027s browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en el cifrado de cookie en phpMyAdmin. El descifrado del nombre de usuario/contrase\u00f1a es vulnerable a un ataque oracle de relleno. Esto puede permitir a un atacante que tenga acceso al archivo de cookies del usuario del navegador para descifrar el nombre de usuario y la contrase\u00f1a. Adem\u00e1s, se utiliza la el mismo vector de inicializaci\u00f3n (IV) para hash del nombre de usuario y contrase\u00f1a almacenados en la cookie de phpMyAdmin. Si un usuario tiene la misma contrase\u00f1a que su nombre de usuario, un atacante que examine la cookie del navegador puede ver que son iguales, pero el atacante no puede decodificar directamente estos valores de la cookie ya que sigue siendo hash. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6606",
"lastModified": "2024-11-21T02:56:25.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:10.420",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94114"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-29"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94114"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-29"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-06-05 05:29
Modified
2024-11-21 04:21
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0C2D80A4-360E-4B49-AC0E-A812D0FCE4C3",
"versionEndExcluding": "4.9.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature."
},
{
"lang": "es",
"value": "Fue descubierto un problema en phpMyAdmin anterior de la versi\u00f3n d 4.9.0.1. Se inform\u00f3 de una vulnerabilidad en la que se puede utilizar un nombre de base de datos especialmente dise\u00f1ado para desencadenar un ataque de inyecci\u00f3n de SQL a trav\u00e9s de la funci\u00f3n del dise\u00f1ador."
}
],
"id": "CVE-2019-11768",
"lastModified": "2024-11-21T04:21:45.297",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-06-05T05:29:00.227",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/108617"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/108617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-3/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-09-14 01:59
Modified
2024-11-21 02:35
Severity ?
Summary
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.3.0 | |
| phpmyadmin | phpmyadmin | 4.3.1 | |
| phpmyadmin | phpmyadmin | 4.3.2 | |
| phpmyadmin | phpmyadmin | 4.3.3 | |
| phpmyadmin | phpmyadmin | 4.3.4 | |
| phpmyadmin | phpmyadmin | 4.3.5 | |
| phpmyadmin | phpmyadmin | 4.3.6 | |
| phpmyadmin | phpmyadmin | 4.3.7 | |
| phpmyadmin | phpmyadmin | 4.3.8 | |
| phpmyadmin | phpmyadmin | 4.3.9 | |
| phpmyadmin | phpmyadmin | 4.3.10 | |
| phpmyadmin | phpmyadmin | 4.3.11 | |
| phpmyadmin | phpmyadmin | 4.3.12 | |
| phpmyadmin | phpmyadmin | 4.3.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AA505-40A6-4767-A848-3B00EA8EDD7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "347983D5-CB40-44C9-8C68-10A8417F4BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "16C9023A-2E9A-4DDA-84A8-D6E2A4F1019F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "564261EC-AEA3-4BDD-9E7D-56B29628D16F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2154D6EC-C492-4035-B5E6-9A5BAB2F2164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "819ECCB5-C0D7-47D0-8479-2C36734F47B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3499F9A7-3F4E-4AD3-94FB-242FD135B851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "53CFCBBC-E941-4167-A474-7C88F6C489AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "CE374D7A-90E3-42A1-A02A-88B03AB70605",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2088A96D-C4C6-4FA9-8594-3DAA81D48443",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F02404-0D50-4222-B24D-6D5E34A6E60F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "254D4A65-99B4-4594-8929-1D0481DB170B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D679D05B-58B9-4089-B002-F60646D6283F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "616ECF02-5687-4C6B-A8AC-976E7A376B5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha."
},
{
"lang": "es",
"value": "Vulnerabilidad en libraries/plugins/auth/AuthenticationCookie.class.php en phpMyAdmin 4.3.x en versiones anteriores a 4.3.13.2 y 4.4.x en versiones anteriores a 4.4.14.1, permite a atacantes remotos eludir un mecanismo de protecci\u00f3n reCaptcha m\u00faltiple contra suposiciones de credenciales por la fuerza aportando una respuesta correcta a un \u00fanico reCaptcha."
}
],
"id": "CVE-2015-6830",
"lastModified": "2024-11-21T02:35:44.450",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-09-14T01:59:08.903",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/76674"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1033546"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/76674"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1033546"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2015-4/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach."
},
{
"lang": "es",
"value": "La funci\u00f3n suggestPassword en js/functions.js en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 se basa en la funci\u00f3n Math.random JavaScript, lo que hace que sea m\u00e1s f\u00e1cil para atacantes remotos adivinar las contrase\u00f1as a trav\u00e9s de una aproximaci\u00f3n por fuerza bruta."
}
],
"id": "CVE-2016-1927",
"lastModified": "2024-11-21T02:47:22.463",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:00.140",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8dedcc1a175eb07debd4fe116407c43694c60b22"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/912856b432d794201884c36e5f390d446339b6e4"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
},
{
"lang": "en",
"value": "CWE-255"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin que implicaba la funcionalidad de reemplazo del nombre de usuario %u de las funcionalidades SaveDir y UploadDir. Cuando se configura la sustituci\u00f3n de nombre de usuario, se puede utilizar un nombre usuario especialmente manipulado para eludir las restricciones que atraviesan el sistema de archivos. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6614",
"lastModified": "2024-11-21T02:56:27.053",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:20.970",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94366"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-37"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94366"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-37"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-01-26 17:29
Modified
2024-11-21 04:47
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/106727 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2019-2/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106727 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2019-2/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D8759058-2262-448B-9C51-AA548022C443",
"versionEndIncluding": "4.8.4",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Se ha detectado una vulnerabilidad en la que un nombre de usuario especialmente manipulado puede emplearse para provocar un ataque de inyecci\u00f3n SQL mediante la funcionalidad \"designer\"."
}
],
"id": "CVE-2019-6798",
"lastModified": "2024-11-21T04:47:10.773",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-01-26T17:29:00.247",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106727"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106727"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-08-04 19:41
Modified
2024-11-21 00:49
Severity ?
Summary
phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CCE0DD38-2444-4E7C-86BB-B1650DFB0C7D",
"versionEndIncluding": "2.11.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack."
},
{
"lang": "es",
"value": "phpMyAdmin anterior a 2.11.8 no previene adecuadamente sus p\u00e1ginas con marcos (frames) que apuntan a otros dominios, los que puede facilitar a atacantes remotos llevar a cabo actividades de phishing o suplantaci\u00f3n a trav\u00e9s de un ataje de marcos en sitios cruzados."
}
],
"id": "CVE-2008-3456",
"lastModified": "2024-11-21T00:49:18.123",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-08-04T19:41:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31263"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31312"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32834"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44050"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31312"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/Cross-Site_Framing_inphpMyAdmin2.11.7.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-12-22 20:55
Modified
2024-11-21 01:32
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 | |
| phpmyadmin | phpmyadmin | 3.4.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) libraries/config/ConfigFile.class.php en el interfaz de configuraci\u00f3n en phpMyAdmin v3.4.x antes de v3.4.9, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro host."
}
],
"id": "CVE-2011-4782",
"lastModified": "2024-11-21T01:32:59.580",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-12-22T20:55:01.030",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cd"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71938"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cd"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:198"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71938"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-11-15 00:46
Modified
2024-11-21 00:39
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65E755CE-C312-427E-B256-4F743D77FF75",
"versionEndIncluding": "2.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el db_create.php del phpMyAdmin anterior al 2.11.2.1 permite a usuarios remotos autenticados con privilegios de CREATE DATABASE la inyecci\u00f3n de secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de un elemento IMG con codificaci\u00f3n hex en el par\u00e1metro db de una petici\u00f3n POST. Vulnerabilidad diferente a la CVE-2006-6942."
}
],
"id": "CVE-2007-5977",
"lastModified": "2024-11-21T00:39:05.317",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-11-15T00:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27630"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27753"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38404"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27630"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27753"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/project/shownotes.php?release_id=553333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26512"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3824"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38404"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-01-19 16:30
Modified
2024-11-21 00:58
Severity ?
Summary
libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors."
},
{
"lang": "es",
"value": "libraries/File.class.php en phpMyAdmin v2.11.x anterior a v2.11.10 utiliza nombres de ficheros previsibles para los ficheros temporales, lo que tiene un impacto y vectores de ataque desconocidos."
}
],
"id": "CVE-2008-7252",
"lastModified": "2024-11-21T00:58:39.627",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-01-19T16:30:00.633",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39503"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/37826"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/QA_2_11/phpMyAdmin/libraries/File.class.php?r1=11528\u0026r2=11527\u0026pathrev=11528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=11528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/38211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/39503"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/37826"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/0910"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-08 11:03
Modified
2024-11-21 00:02
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation."
}
],
"id": "CVE-2005-3665",
"lastModified": "2024-11-21T00:02:23.240",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-08T11:03:00.000",
"references": [
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17895"
},
{
"source": "security@debian.org",
"url": "http://secunia.com/advisories/17957"
},
{
"source": "security@debian.org",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "security@debian.org",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "security@debian.org",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "security@debian.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"source": "security@debian.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
},
{
"source": "security@debian.org",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "security@debian.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15735"
},
{
"source": "security@debian.org",
"url": "http://www.vupen.com/english/advisories/2005/2772"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17895"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/22781"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/15735"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/2772"
}
],
"sourceIdentifier": "security@debian.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-07-14 23:55
Modified
2024-11-21 01:28
Severity ?
Summary
Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta-\u003ename][transformation] parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en libraries/display_tbl.lib.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 cuando una determinada transformaci\u00f3n MIME est\u00e1 habilitada, permitiendo a usuarios remotos autenticados incluir y ejecutar archivos locales a trav\u00e9s de un .. (punto punto) en el par\u00e1metro GLOBALS[mime_map][$meta-\u003ename][transformation].\r\n"
}
],
"id": "CVE-2011-2508",
"lastModified": "2024-11-21T01:28:25.690",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-07-14T23:55:05.053",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "secalert@redhat.com",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/73614"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/73614"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-12-26 02:59
Modified
2024-11-21 01:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades XSS en phpMyAdmin 3.4.x anterior a 3.4.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML atrav\u00e9s de una fila modificada que lanza un mensaje de confirmaci\u00f3n err\u00f3neamente construido despu\u00e9s de una edici\u00f3n en una l\u00ednea y operaciones de guardar, relacionado con (1) js/functions.js y (2) js/tbl_structure.js."
}
],
"id": "CVE-2011-3591",
"lastModified": "2024-11-21T01:30:48.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-12-26T02:59:05.143",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/09/30/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=738681"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-01-10 05:00
Modified
2024-11-20 23:50
Severity ?
Summary
phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.4.0 | |
| phpmyadmin | phpmyadmin | 2.5.0 | |
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.7 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl2 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter."
}
],
"id": "CVE-2004-1148",
"lastModified": "2024-11-20T23:50:13.137",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-01-10T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-03-19 01:02
Modified
2024-11-21 00:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.1 allows remote attackers to inject arbitrary web script or HTML via the set_theme parameter."
}
],
"id": "CVE-2006-1258",
"lastModified": "2024-11-21T00:08:26.550",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-03-19T01:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19277"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1015776"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/23943"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17142"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/0991"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/19277"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015776"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/23943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/17142"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/0991"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25305"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-07-14 23:55
Modified
2024-11-21 01:28
Severity ?
Summary
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a \"remote variable manipulation vulnerability.\""
},
{
"lang": "es",
"value": "libraries/auth/swekey/swekey.auth.lib.php en la funci\u00f3n de autenticaci\u00f3n Swekey en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 asigna valores a par\u00e1metros arbitrarios referenciados en la cadena de consulta, permitiendo a atacantes remotos modificar el array superglobal SESI\u00d3N a trav\u00e9s de una solicitud manipulada, relacionado con \"vulnerabilidad de manipulaci\u00f3n de variable remota\""
}
],
"id": "CVE-2011-2505",
"lastModified": "2024-11-21T01:28:25.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-07-14T23:55:04.833",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "secalert@redhat.com",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/73611"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=7ebd958b2bf59f96fecd5b3322bdbd0b244a7967"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/73611"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-08-01 19:55
Modified
2024-11-21 01:28
Severity ?
Summary
Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de directorio transversal en sql.php en phpMyAdmin v3.4.x anterior a v3.4.3.2, cuando la configuraci\u00f3n de almacenamiento est\u00e1 activa, permite a atacantes remotos incluir y ejecutar ficheros locales de su elecci\u00f3n a trav\u00e9s de secuencias de salto de directorio en una transformaci\u00f3n del par\u00e1metro MIME-type."
}
],
"id": "CVE-2011-2643",
"lastModified": "2024-11-21T01:28:40.327",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-08-01T19:55:01.383",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725382"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68767"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=f63e1bb42a37401b2fdfcd2e66cce92b7ea2025c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-10.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68767"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-11-04 17:15
Modified
2024-11-21 05:13
Severity ?
Summary
phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because "the CSV file is accurately generated based on the database contents.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf | Broken Link, Third Party Advisory | |
| cve@mitre.org | https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf | Broken Link, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE0370B6-7FC2-411F-95B7-FD2F2688B1A7",
"versionEndIncluding": "5.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin through 5.0.2 allows CSV injection via Export Section. NOTE: the vendor disputes this because \"the CSV file is accurately generated based on the database contents."
},
{
"lang": "es",
"value": "** EN DISPUTA ** phpMyAdmin versiones hasta 5.0.2, permite una inyecci\u00f3n CSV por medio de una Export SectionNOTA: el vendedor lo discute porque \"el archivo CSV se genera con precisi\u00f3n en base al contenido de la base de datos\""
}
],
"id": "CVE-2020-22278",
"lastModified": "2024-11-21T05:13:13.937",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-11-04T17:15:13.130",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"url": "https://cert.ikiu.ac.ir/public-files/news/document/CVE-99/CVE-2020-22278.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://mega.nz/file/ySQnlQSR#vXzY46mgf0CE2ysYpWpbE4O6T_g37--rtaL8pqdHcQs"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1236"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-11 17:29
Modified
2024-11-21 03:58
Severity ?
Summary
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/106175 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-7/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106175 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-7/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B23EF649-15EC-4917-992D-19865A01232B",
"versionEndIncluding": "4.7.6",
"versionStartIncluding": "4.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55192B84-35F4-4A73-81EC-B55CD0FD0498",
"versionEndExcluding": "4.8.4",
"versionStartIncluding": "4.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc."
},
{
"lang": "es",
"value": "phpMyAdmin, en versiones 4.7.x y 4.8.x anteriores a la 4.8.4, se ha visto afectado por una serie de errores Cross-Site Request Forgery (CSRF). Al enga\u00f1ar a un usuario para que haga clic en una URL maliciosa, es posible realizar operaciones SQL da\u00f1inas, como renombrar bases de datos, crear nuevas tablas/rutinas, eliminar p\u00e1ginas del dise\u00f1ador, a\u00f1adir/eliminar usuarios, actualizar contrase\u00f1as de usuarios, matar procesos SQL, etc."
}
],
"id": "CVE-2018-19969",
"lastModified": "2024-11-21T03:58:54.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-11T17:29:00.273",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106175"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-7/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106175"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-7/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-12-08 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58D3F904-8C3C-46A5-A7A6-8EFA49648687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "B6360AD1-B295-4123-A6AC-99B13FA12C1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "29255C68-9B71-45DF-95B0-C84762B8CDD6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows remote attackers to cause a denial of service (resource consumption) via a long password."
},
{
"lang": "es",
"value": "libraries/common.inc.php en phpMyAdmin 4.0.x anterior a 4.0.10.7, 4.1.x anterior a 4.1.14.8, y 4.2.x anterior a 4.2.13.1 permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de recursos) a trav\u00e9s de una contrase\u00f1a larga."
}
],
"id": "CVE-2014-9218",
"lastModified": "2024-11-21T02:20:25.100",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-12-08T11:59:11.877",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71434"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99140"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-17.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71434"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99140"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/095729d81205f15f40d216d25917017da4c2fff8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1ac863c7573d12012374d5d41e5c7dc5505ea6e1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/62b2c918d26cc78d1763945e3d44d1a63294a819"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario autenticado puede desencadenar un ataque de denegaci\u00f3n de servicio (DoS) al introducir una contrase\u00f1a muy larga en el cuadro de di\u00e1logo de cambio de contrase\u00f1a. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6630",
"lastModified": "2024-11-21T02:56:30.893",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:39.660",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92501"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-53"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-53"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-06-21 20:29
Modified
2024-11-21 03:45
Severity ?
Summary
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/104530 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.securitytracker.com/id/1041187 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-3/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/104530 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041187 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-3/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AFC244E8-479C-4AA1-B179-187BBCDED19E",
"versionEndExcluding": "4.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en js/designer/move.js en versiones anteriores a la 4.8.2 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un nombre de base de datos manipulado para desencadenar un ataque XSS cuando se referencia esa base de datos desde la caracter\u00edstica Designer."
}
],
"id": "CVE-2018-12581",
"lastModified": "2024-11-21T03:45:28.650",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-06-21T20:29:00.263",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104530"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041187"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-3/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104530"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041187"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-3/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un nombre de tabla y/o de base de datos especialmente manipulada puede ser utilizado para desencadenar un ataque de inyecci\u00f3n SQL a trav\u00e9s de la funcionalidad de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6611",
"lastModified": "2024-11-21T02:56:26.573",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:17.110",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94117"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-34"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94117"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-34"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg[\u0027AllowArbitraryServer\u0027]=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario no autenticado puede ejecutar un ataque de denegaci\u00f3n de servicio cuando phpMyAdmin se ejecuta con $cfg[\u0027AllowArbitraryServer\u0027]=true. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9860",
"lastModified": "2024-11-21T03:01:54.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:00.273",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-06-21 20:29
Modified
2024-11-21 03:45
Severity ?
Summary
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "04FBC08B-0D3A-44E3-8C3D-82F6723EA7D9",
"versionEndExcluding": "4.8.2",
"versionStartIncluding": "4.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg[\u0027AllowArbitraryServer\u0027] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg[\u0027ServerDefault\u0027] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication)."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en phpMyAdmin en versiones 4.38.3x anteriores a la 4.8.2 por el cual un atacante puede incluir (ver y, potencialmente, ejecutar) archivos en el servidor. La vulnerabilidad procede de una porci\u00f3n de c\u00f3digo en el que las p\u00e1ginas se redirigen y cargan en phpMyAdmin y se realiza una prueba inadecuada para p\u00e1ginas en la lista blanca. Un atacante debe estar autenticado, excepto en el caso en el que \"$cfg[\u0027AllowArbitraryServer\u0027] = true\" (en el que un atacante puede especificar cualquier host que ya controle y ejecutar c\u00f3digo arbitrario en phpMyAdmin) y en el caso \"$cfg[\u0027ServerDefault\u0027] = 0\" (que omite el requisito de inicio de sesi\u00f3n y ejecuta el c\u00f3digo vulnerable sin autenticaci\u00f3n)."
}
],
"id": "CVE-2018-12613",
"lastModified": "2024-11-21T03:45:32.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-06-21T20:29:00.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104532"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44924/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44928/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45020/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/104532"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44924/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44928/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45020/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-4/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-11 17:29
Modified
2024-11-21 03:58
Severity ?
Summary
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/106178 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-6/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106178 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-6/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1ED0CAE-0B60-4038-8F53-5C01551867C1",
"versionEndExcluding": "4.8.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system."
},
{
"lang": "es",
"value": "Un atacante puede explotar phpMyAdmin en versiones anteriores a la 4.8.4 para filtrar el contenido de un archivo local debido a un error en la caracter\u00edstica de transformaci\u00f3n. El atacante debe tener acceso a las tablas de configuraci\u00f3n \"Configuration Storage\" de phpMyAdmin, aunque pueden crearse f\u00e1cilmente en cualquier base de datos a la que tenga acceso. Un atacante debe tener credenciales v\u00e1lidas para iniciar sesi\u00f3n en phpMyAdmin; la vulnerabilidad no permite que un atacante omita el sistema de inicio de sesi\u00f3n."
}
],
"id": "CVE-2018-19968",
"lastModified": "2024-11-21T03:58:54.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-11T17:29:00.227",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106178"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106178"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-6/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-11-17 19:55
Modified
2024-11-21 01:30
Severity ?
Summary
phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message."
},
{
"lang": "es",
"value": "phpmyadmin.css.php en phpMyAdmin v3.4.x anterior a v3.4.6 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de un par\u00e1metro jsarray-typed js_frame a phpmyadmin.css.php, lo cual revela la ruta de instalaci\u00f3n en un mensaje de error."
}
],
"id": "CVE-2011-3646",
"lastModified": "2024-11-21T01:30:54.623",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-11-17T19:55:01.313",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46874"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-31 19:59
Modified
2024-11-21 02:56
Severity ?
Summary
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F1DD1A4E-D5B4-45E4-A22D-8F9F7173FA04",
"versionEndIncluding": "4.0.10.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.9:*:*:*:*:*:*:*",
"matchCriteriaId": "09D97993-070A-4D32-B560-38AF28C87A59",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "33130418-95AC-41D2-B8B0-A107C9CABCFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors."
},
{
"lang": "es",
"value": "La secuencia de comandos de instalaci\u00f3n para phpMyAdmin en versiones anteriores a 4.0.10.19, 4.4.x en versiones anteriores a 4.4.15.10 y 4.6.x en versiones anteriores a 4.6.6 permite a atacantes remotos realizar ataques de falsificaci\u00f3n de solicitud del lado del servidor (SSRF) a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-6621",
"lastModified": "2024-11-21T02:56:29.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-31T19:59:00.260",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95914"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-44/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95914"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-44/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario puede ejecutar un ataque de ejecuci\u00f3n de c\u00f3digo remoto contra un servidor cuando se est\u00e1 ejecutando phpMyAdmin como una aplicaci\u00f3n CGI. Bajo ciertas configuraciones de servidor, un usuario puede pasar una cadena de consulta que es ejecutada como un argumento de l\u00ednea de comando por el archivo generator_plugin.sh. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6631",
"lastModified": "2024-11-21T02:56:31.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:40.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92496"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-54"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92496"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-54"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| opensuse | leap | 42.1 | |
| opensuse | opensuse | 13.1 | |
| opensuse | opensuse | 13.2 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an \"invalid JSON\" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permiten a atacantes remotos inyectar comandos web o HTML arbitrarios a trav\u00e9s de vectores relacionados con (1) campos de datos de certificado de server-privilegies en la p\u00e1gina de privilegios de usuario, (2) un error \"invalid JSON\" en la consola de error, (3) un nombre de database en las columnas centrales de implementaci\u00f3n, (4) un nombre de grupo o (5) un nombre de b\u00fasqueda en la implementaci\u00f3n de marcadores."
}
],
"id": "CVE-2016-5705",
"lastModified": "2024-11-21T02:54:51.737",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:17.393",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91378"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-21/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91378"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/03f73d48369703e0d3584699b08e24891c3295b8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0b7416c5f4439ed3f11c023785f2d4c49a1b09fc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/364732e309cccb3fb56c938ed8d8bc0e04a3ca98"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/36df83a97a7f140fdb008b727a94f882847c6a6f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57ae483bad33059a885366d5445b7e1f6f29860a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-21/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Debido a la limitaci\u00f3n en la coincidencia de URL, fue posible eludir la protecci\u00f3n de lista blanca URL. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9861",
"lastModified": "2024-11-21T03:01:54.380",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:01.650",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94535"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-66"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94535"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-66"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94525 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-65 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con un valor de par\u00e1metro de solicitud manipulado es posible iniciar un ataque de denegaci\u00f3n de servicio en la funcionalidad de importaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9859",
"lastModified": "2024-11-21T03:01:54.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:59.023",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94525"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-65"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-05-16 10:02
Modified
2024-11-21 00:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts."
}
],
"evaluatorSolution": "Some releases of phpMyAdmin before 2.8.0.4 are affected (2.6.2 tested vulnerable). \r\nThis vulnerability is addressed in the following product release:\r\nphpMyAdmin, phpMyAdmin, 2.8.0.4",
"id": "CVE-2006-2418",
"lastModified": "2024-11-21T00:11:16.510",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-05-16T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20113"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22781"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26441"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/20627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/22781"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/17973"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/1794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26441"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-07-14 23:55
Modified
2024-11-21 01:28
Severity ?
Summary
libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array."
},
{
"lang": "es",
"value": "libraries/server_synchronize.lib.php en la implementaci\u00f3n Synchronize en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 no entrecomilla correctamente las expresiones regulares, permitiendo a usuarios remotos autenticados inyectar PCRE (conocido como PREG_REPLACE_EVAL) y ejecutar c\u00f3digo PHP arbitrario, mediante la modificaci\u00f3n del array superglobal SESI\u00d3N."
}
],
"id": "CVE-2011-2507",
"lastModified": "2024-11-21T01:28:25.547",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-07-14T23:55:04.973",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=69fb0f8e7dc38075427aceaf09bcac697d0590ff"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "secalert@redhat.com",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/73613"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-pregreplace-rce-poc.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=69fb0f8e7dc38075427aceaf09bcac697d0590ff"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/73613"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.5.0 | |
| phpmyadmin | phpmyadmin | 4.5.0.1 | |
| phpmyadmin | phpmyadmin | 4.5.0.2 | |
| phpmyadmin | phpmyadmin | 4.5.1 | |
| phpmyadmin | phpmyadmin | 4.5.2 | |
| phpmyadmin | phpmyadmin | 4.5.3 | |
| fedoraproject | fedora | 22 | |
| fedoraproject | fedora | 23 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en el editor SQL en phpMyAdmin 4.5.x en versiones anteriores a 4.5.4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una consulta SQL que desencadena datos JSON en una respuesta."
}
],
"id": "CVE-2016-2045",
"lastModified": "2024-11-21T02:47:40.907",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:08.500",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0a24f92d081033576bfdd9d4bdec1a54501734c1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/11496890d7e21786cbfd9fd17ab968f498116b3f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-04-06 19:55
Modified
2024-11-21 01:38
Severity ?
Summary
show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 | |
| phpmyadmin | phpmyadmin | 3.4.1.0 | |
| phpmyadmin | phpmyadmin | 3.4.2.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.0 | |
| phpmyadmin | phpmyadmin | 3.4.3.1 | |
| phpmyadmin | phpmyadmin | 3.4.3.2 | |
| phpmyadmin | phpmyadmin | 3.4.4.0 | |
| phpmyadmin | phpmyadmin | 3.4.5.0 | |
| phpmyadmin | phpmyadmin | 3.4.6.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.0 | |
| phpmyadmin | phpmyadmin | 3.4.7.1 | |
| phpmyadmin | phpmyadmin | 3.4.8.0 | |
| phpmyadmin | phpmyadmin | 3.4.9.0 | |
| phpmyadmin | phpmyadmin | 3.4.10.0 | |
| phpmyadmin | phpmyadmin | 3.4.10.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9AC8F001-B2D6-49AD-94E7-673E8BEC958C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "AE9EFA08-1838-46A9-A851-A0540C60739D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B231B0D4-F971-4D4F-97CE-74951DF2B681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FF6604AE-12E8-43F8-9170-557009F34928",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CD67845D-C1AD-46EF-A2EF-6C979E3363BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C36E012-A028-4A47-9EAB-553D18F5E053",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6044293D-28C5-4B35-B046-E8984A2AA029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C774C482-4EE2-47DE-BCC4-35020E02A9AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "10F44BD9-A868-420B-9B9F-9CC4809A9C49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "706127A4-C6E2-4A6C-81EC-3B890E677273",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file."
},
{
"lang": "es",
"value": "show_config_errors.php en phpMyAdmin v3.4.x y anterior a v3.4.10.2, cuando un archivo de configuraci\u00f3n no existe, permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud directa, lo cual revela la ruta de instalaci\u00f3n en un mensaje de error acerca de este archivo que falta."
}
],
"id": "CVE-2012-1902",
"lastModified": "2024-11-21T01:38:00.770",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-04-06T19:55:01.717",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52858"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74608"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079435.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079475.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079566.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:050"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74608"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.4.15.8 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Llamando a algunas secuencias de comandos que son parte de phpMyAdmin de forma inesperada, es posible desencadenar phpMyAdmin para mostrar un mensaje de error de PHP que contiene la ruta completa del directorio donde phpMyAdmin est\u00e1 instalado. Durante un tiempo de espera de ejecuci\u00f3n en la funcionalidad de exportaci\u00f3n, los errores que contienen la ruta completa del directorio de phpMyAdmin se escriben en el archivo de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas. Esta CVE es para el problema PMA_shutdownDuringExport."
}
],
"id": "CVE-2016-9855",
"lastModified": "2024-11-21T03:01:53.443",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:53.960",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:53
Severity ?
Summary
The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.5.0 | |
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.2_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.3 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.7 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors."
}
],
"id": "CVE-2004-2630",
"lastModified": "2024-11-20T23:53:50.750",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=full-disclosure\u0026m=109810251501643\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/12813"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12859"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/alerts/2004/Oct/1011761.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/10715"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/11391"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17698"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=109816584519779\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=full-disclosure\u0026m=109810251501643\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/12813"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12859"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/alerts/2004/Oct/1011761.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200410-14.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/10715"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2004-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/11391"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17698"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-05 11:55
Modified
2024-11-21 02:18
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5CA497-47A6-4A42-A720-CCB2AD82B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC60DE84-575A-4031-8B78-AD67C60595AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x anterior a 4.0.10.5, 4.1.x anterior a 4.1.14.6, y 4.2.x anterior a 4.2.10.1 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre manipulado de (1) base de datos o (2) tabla, relacionado con el c\u00f3digo libraries/DatabaseInterface.class.php para las salidas de purificaci\u00f3n de SQL y el c\u00f3digo js/server_status_monitor.js para la p\u00e1gina del monitor de servidores."
}
],
"id": "CVE-2014-8326",
"lastModified": "2024-11-21T02:18:52.557",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-11-05T11:55:07.027",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/70731"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-12.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/70731"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7b8962dede7631298c81e2c1cd267b81f1e08a8c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/bd68c54d1beeef79d237e8bfda44690834012a76"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/95738 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-7 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95738 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-7 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "18ADFF10-3935-419D-A5F2-589A702A857F",
"versionEndExcluding": "4.0.10.19",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4FEFDD77-6453-4FA9-811D-A4A14BBD17A3",
"versionEndExcluding": "4.4.15.10",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A6BBF43D-4C74-466D-986C-FABDCDB75069",
"versionEndExcluding": "4.6.6",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name"
},
{
"lang": "es",
"value": "phpMyAdmin en las versiones 4.0, 4.4 y 4.6 es vulnerable a un ataque de tipo DOS en el estado de replicaci\u00f3n al usar un nombre de tabla especialmente creado."
}
],
"id": "CVE-2017-1000018",
"lastModified": "2024-11-21T03:03:58.870",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.517",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95738"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95738"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-7"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. La coincidencia de nombres de usuario para las reglas de permitir/denegar puede dar lugar a coincidencias err\u00f3neas y la detecci\u00f3n del nombre de usuario en la regla debido al tiempo de ejecuci\u00f3n no constante. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9850",
"lastModified": "2024-11-21T03:01:52.673",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:48.130",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94529"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-61"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94529"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-61"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con un nombre de usuario o nombre de tabla manipulado, era posible inyectar sentencias SQL en la funcionalidad de seguimiento que ejecutar\u00e1 con los privilegios del usuario de control. Esto da acceso de lectura y escritura a las tablas de la base de datos de almacenamiento de configuraci\u00f3n, y si el usuario de control tiene los privilegios necesarios, acceso de lectura para algunas tablas de la base de datos MySQL. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9864",
"lastModified": "2024-11-21T03:01:54.817",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:06.057",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94533"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-69"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94533"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-69"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-21 19:55
Modified
2024-11-21 01:42
Severity ?
Summary
show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file."
},
{
"lang": "es",
"value": "show_config_errors.php en phpMyAdmin v3.5.x anterior a v3.5.2.1 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud directa, la cual revela la ruta de instalaci\u00f3n en un mensaje de error, relacionada con la no inclusi\u00f3n del fichero de librer\u00eda common.inc.php."
}
],
"id": "CVE-2012-4219",
"lastModified": "2024-11-21T01:42:28.320",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-21T19:55:00.903",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15513071"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0f0c2f1e2b3ece41cc1bb99a9931c8fcc7c917bc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15513071"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-22 05:15
Modified
2024-11-21 04:56
Severity ?
Summary
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| suse | package_hub | - | |
| suse | linux_enterprise | 12.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "481F6868-9D3C-4AF8-BDF6-43A7551537A1",
"versionEndExcluding": "4.9.5",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C68997D3-1D7B-47C7-8092-0A3412C21353",
"versionEndExcluding": "5.0.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*",
"matchCriteriaId": "284A8DA0-317B-4BBE-AECB-7E91BBF0DD3B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack."
},
{
"lang": "es",
"value": "En phpMyAdmin versiones 4.x anteriores a 4.9.5 y versiones 5.x anteriores a 5.0.2, se detect\u00f3 una vulnerabilidad de inyecci\u00f3n SQL donde un c\u00f3digo malicioso podr\u00eda ser usado para desencadenar un ataque de tipo XSS mediante la recuperaci\u00f3n y visualizaci\u00f3n de resultados (en archivo tbl_get_field.php y biblioteca libraries/clases/Display/Results.php). El atacante debe poder insertar datos dise\u00f1ados en determinadas tablas de la base de datos, que cuando se recuperaban (por ejemplo, por medio de la pesta\u00f1a Browse) pueden desencadenar el ataque de tipo XSS."
}
],
"id": "CVE-2020-10803",
"lastModified": "2024-11-21T04:56:06.247",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-22T05:15:11.667",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00046.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00050.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link",
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAVW3SUKWR5RF5LZ6SARCYOWBIFUIWOJ/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUG3IRITW2LUBGR5LSQMP7MVRTELHZJK/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZI6EQVRRIG252DY3MBT33BJVCSYDMQO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-4/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-09-08 23:03
Modified
2024-11-21 00:00
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5DAB33AF-D8A9-444F-AC69-FACCFA0EEB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the Username to libraries/auth/cookie.auth.lib.php or (2) the error parameter to error.php."
}
],
"id": "CVE-2005-2869",
"lastModified": "2024-11-21T00:00:37.320",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-09-08T23:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16605"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16605"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1240880\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1265740\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-09-10 20:00
Modified
2024-11-21 01:18
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D795276F-CF8D-48F9-AC89-773BD009196F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en setup/frames/index.inc.php en el ficheros de comandos de configuraci\u00f3n en phpMyAdmin v3.x anteriores a v3.3.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del nombre del servidor.\r\n"
}
],
"id": "CVE-2010-3263",
"lastModified": "2024-11-21T01:18:23.617",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-09-10T20:00:01.723",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41210"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:186"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61675"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41210"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:186"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61675"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-09-25 22:55
Modified
2024-11-21 01:44
Severity ?
Summary
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack."
},
{
"lang": "es",
"value": "phpMyAdmin v3.5.2.2, tal y como se distribuy\u00f3 en el \u0027mirror\u0027 CDNetworks-kr-1 durante un per\u00edodo de tiempo indeterminado en el a\u00f1o 2012, contiene una modificaci\u00f3n introducida externamente (Un troyano) en server_sync.php, lo que permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de un ataque de inyecci\u00f3n eval.\r\n"
}
],
"evaluatorComment": "Although not found in all distributions of this software, the vulnerability was scored assuming that it was. End-users will need to identify whether their distribution does in fact contain the vulnerability.",
"id": "CVE-2012-5159",
"lastModified": "2024-11-21T01:44:10.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-09-25T22:55:00.813",
"references": [
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2012/q3/562"
},
{
"source": "cve@mitre.org",
"url": "http://sourceforge.net/blog/phpmyadmin-back-door/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/55672"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2012/q3/562"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/blog/phpmyadmin-back-door/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2012-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/55672"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-19 23:17
Modified
2024-11-21 00:38
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51C3099C-F649-4043-8BE8-7B881A8CD665",
"versionEndIncluding": "2.11.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de tipo cross-site scripting (XSS) en phpMyAdmin versiones anteriores a 2.11.1.2, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de cierta entrada disponible en (1) PHP_SELF en (a) el archivo server_status.php, y las bibliotecas (b) grab_globals.lib.php, (c) display_change_password.lib.php y (d) common.lib.php en libraries/; y ciertas entradas disponibles en PHP_SELF y (2) PATH_INFO en la biblioteca libraries/common.inc.php. NOTA: tambi\u00e9n puede haber otros vectores relacionados con (3) REQUEST_URI."
}
],
"id": "CVE-2007-5589",
"lastModified": "2024-11-21T00:38:15.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-10-19T23:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/37939"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27246"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27506"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/27595"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/29323"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/26301"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3535"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37292"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/37939"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796\u0026r2=10795\u0026pathrev=10796"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev\u0026revision=10796"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/27246"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/27595"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/29323"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2007/dsa-1403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitrustgroup.com/advisories/TDG-advisory071015a.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/26301"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3535"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=333661"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00040.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-20 11:12
Modified
2024-11-21 02:11
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5CA497-47A6-4A42-A720-CCB2AD82B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en js/functions.js en phpMyAdmin 4.0.x anterior a 4.0.10.1, 4.1.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.6 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) un nombre de tabla manipulado o (2) un nombre de columna manipulado que no se maneja debidamente durante la construcci\u00f3n de un mensaje de confirmaci\u00f3n AJAX."
}
],
"id": "CVE-2014-4986",
"lastModified": "2024-11-21T02:11:13.507",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-07-20T11:12:51.243",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68803"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68803"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/29a1f56495a7d1d98da31a614f23c0819a606a4d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-09-13 13:15
Modified
2024-11-21 04:23
Severity ?
Summary
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| fedoraproject | fedora | 29 | |
| fedoraproject | fedora | 30 | |
| fedoraproject | fedora | 31 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2496187A-2378-4463-B2F0-18BBE0441570",
"versionEndIncluding": "4.9.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page."
},
{
"lang": "es",
"value": "Un problema de tipo CSRF en phpMyAdmin versi\u00f3n 4.9.0.1, permite la eliminaci\u00f3n de cualquier servidor en la p\u00e1gina de Setup."
}
],
"id": "CVE-2019-12922",
"lastModified": "2024-11-21T04:23:49.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-09-13T13:15:11.323",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2019/Sep/23"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/47385"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2019/Sep/23"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBLBE6CSC2ZLINIRBUU5XBLXYVBTF3KA/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QJ5BW2VEMD2P23ZYRWHDBEQHOKGKGWD6/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCB3PTGHZ7AJCM6BKCQRRP6HG3OKYCMN/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/47385"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-07 17:28
Modified
2024-11-21 00:22
Severity ?
Summary
Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0_pl2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n de CRLF en PhpMyAdmin 2.7.0-pl2 permite a atacantes remotos inyectar cabeceras HTML de su elecci\u00f3n y conducir ataques de divisionamiento de respuestas HTTP mediante secuencias CRLF en una cookie phpMyAdmin en (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, y posiblemente otros ficheros."
}
],
"id": "CVE-2006-6374",
"lastModified": "2024-11-21T00:22:31.613",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-07T17:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1993"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30703"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1993"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30703"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-12 19:19
Modified
2024-11-21 00:29
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en mysql/phpinfo.php de phpMyAdmin 2.6.1 permite a atacantes remotos inyectar scripts web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro lang[]."
}
],
"id": "CVE-2007-2016",
"lastModified": "2024-11-21T00:29:42.003",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-04-12T19:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35049"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2560"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/465082/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35049"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2560"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/465082/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/92491 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-48 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/92491 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-48 | Patch, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user\u0027s session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un atacante puede determinar si un usuario est\u00e1 registrado en phpMyAdmin. La sesi\u00f3n de usuario, nombre de usuario y contrase\u00f1a no est\u00e1n comprometidas por esta vulnerabilidad. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6625",
"lastModified": "2024-11-21T02:56:30.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:33.317",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92491"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-48"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92491"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-48"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:56
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin before 2.6.2-rc1 allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter."
}
],
"id": "CVE-2005-0992",
"lastModified": "2024-11-20T23:56:21.113",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111264361622660\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14799"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.arrelnet.com/advisories/adv20050403.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/12982"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19940"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111264361622660\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14799"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.arrelnet.com/advisories/adv20050403.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-200504-08.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/12982"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19940"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-10-10 19:15
Modified
2024-11-21 05:20
Severity ?
Summary
phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | backports_sle | 15.0 | |
| opensuse | leap | 15.1 | |
| opensuse | leap | 15.2 | |
| fedoraproject | fedora | 31 | |
| fedoraproject | fedora | 32 | |
| fedoraproject | fedora | 33 | |
| debian | debian_linux | 9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B5118B29-48B2-42DF-BB11-7DE3643EED23",
"versionEndExcluding": "4.9.6",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0EBDC3AD-0E2E-4C86-B0D8-5E7D9E23656E",
"versionEndExcluding": "5.0.3",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
"matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link."
},
{
"lang": "es",
"value": "phpMyAdmin versiones anteriores a 4.9.6 y versiones 5.x anteriores a 5.0.3, permite un ataque de tipo XSS por medio de la funcionalidad de transformaci\u00f3n mediante un enlace dise\u00f1ado"
}
],
"id": "CVE-2020-26934",
"lastModified": "2024-11-21T05:20:32.020",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-10T19:15:12.307",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00027.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHST4E5IJG7IKZTTW3R6MEZPVHJZ472K/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXK37YEHSDYCIPQSYEMN2OFTP2ZLM7DO/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNLGHVDNAEZEGRTUESSSQFM7MZTHIDQ5/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202101-35"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2020-5/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-26 03:34
Modified
2024-11-21 01:53
Severity ?
Summary
export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "export.php (aka the export script) in phpMyAdmin 4.x before 4.0.0-rc3 overwrites global variables on the basis of the contents of the POST superglobal array, which allows remote authenticated users to inject values via a crafted request."
},
{
"lang": "es",
"value": "export.php (tambi\u00e9n conocido como script de exportaci\u00f3n) en phpMyAdmin v4.x antes de v4.0.0-RC3 sobrescribe las variables globales sobre la base del contenido de la matriz superglobal POST, lo que permite a usuarios remotos autenticados inyectar valores a trav\u00e9s de una solicitud manipulada."
}
],
"id": "CVE-2013-3241",
"lastModified": "2024-11-21T01:53:15.217",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-04-26T03:34:23.500",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-5.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-07 17:28
Modified
2024-11-21 00:22
Severity ?
Summary
PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0_pl2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message."
},
{
"lang": "es",
"value": "PhpMyAdmin 2.7.0-pl2 permite a atacantes remotos la obtenci\u00f3n de informaci\u00f3n sensible a traves de una petici\u00f3n directa a la librer\u00eda libraries/common.lib.php, que muestra la ruta en un mensaje de error."
}
],
"id": "CVE-2006-6373",
"lastModified": "2024-11-21T00:22:31.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-07T17:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1993"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1993"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/453432/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30737"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-10-23 21:02
Modified
2024-11-21 00:01
Severity ?
Summary
The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.4_pl3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The register_globals emulation layer in grab_globals.php for phpMyAdmin before 2.6.4-pl3 does not perform safety checks on values in the _FILES array for uploaded files, which allows remote attackers to include arbitrary files by using direct requests to library scripts that do not use grab_globals.php, then modifying certain configuration values for the theme."
}
],
"id": "CVE-2005-3300",
"lastModified": "2024-11-21T00:01:34.027",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-10-23T21:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478."
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=113017591414699\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17289/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1015091"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_162005.73.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15169"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22835"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0478."
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=113017591414699\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17289/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17337"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17559"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17607"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1015091"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-880"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200510-21.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_162005.73.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2005_66_phpmyadmin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15169"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22835"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubrieron problemas de XSS en phpMyAdmin. Esto afecta a la b\u00fasqueda de Zoom (contenido de columna especialmente manipulado puede ser utilizado para desencadenar un ataque XSS); GIS editor (ciertos campos en el gr\u00e1fico GIS editor no se evaden adecuadamente y puede ser utilizado para desencadenar un ataque XSS); Relation view; las siguientes transformaciones: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline y transformation wrapper; XML export; MediaWiki export; Designer; Cuando el servidor MySQL se ejecuta con una directiva log_bin especialmente manipulada; pesta\u00f1a de base de datos; funci\u00f3n de replicaci\u00f3n; y b\u00fasqueda de base de datos. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6607",
"lastModified": "2024-11-21T02:56:25.933",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:11.593",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/93257"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-30"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/93257"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-30"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. In the \"User group\" and \"Designer\" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. En las funciones \"User group\" y \"Designer\", un usuario puede ejecutar un ataque de inyecci\u00f3n SQL contra la cuenta del usuario de control. Todas las versiones 4.6.x (anteriores a 4.6.4) y versiones 4.4.x (anteriores a 4.4.15.8) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6616",
"lastModified": "2024-11-21T02:56:27.380",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:23.470",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95042"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-39"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-39"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-03 14:29
Modified
2024-11-21 03:04
Severity ?
Summary
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ | Exploit, Patch, Third Party Advisory | |
| cve@mitre.org | http://www.securitytracker.com/id/1040163 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.exploit-db.com/exploits/45284/ | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-9/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/ | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1040163 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/45284/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-9/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B002D7A7-970B-451D-B851-0E23214AD0CA",
"versionEndExcluding": "4.7.7",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc."
},
{
"lang": "es",
"value": "Las versiones 4.7.x (anteriores a 4.7.6.1/4.7.7) de phpMyAdmin son vulnerables a una debilidad Cross-Site Request Forgery (CSRF). Al enga\u00f1ar a un usuario para que haga clic en una URL manipulada, es posible realizar operaciones da\u00f1inas para la base de datos, como el borrado de registros, anulaci\u00f3n/truncado de tablas, etc."
}
],
"id": "CVE-2017-1000499",
"lastModified": "2024-11-21T03:04:52.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-03T14:29:00.410",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040163"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45284/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-9/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "http://cyberworldmirror.com/vulnerability-phpmyadmin-lets-attacker-perform-drop-table-single-click/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040163"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45284/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-9/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-01-26 21:15
Modified
2024-11-21 05:13
Severity ?
Summary
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://phpmyadmin.com | Vendor Advisory | |
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog | Third Party Advisory | |
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/issues/15898 | Exploit, Patch, Third Party Advisory | |
| cve@mitre.org | https://github.com/phpmyadmin/phpmyadmin/pull/16004 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://phpmyadmin.com | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/issues/15898 | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/phpmyadmin/phpmyadmin/pull/16004 | Patch, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A1F1DCF-9344-4F54-9266-D8BE32E89223",
"versionEndExcluding": "5.2.0",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en la funci\u00f3n getTableCreationQuery en CreateAddField.php en phpMyAdmin 5.x anterior a 5.2.0 a trav\u00e9s de los par\u00e1metros tbl_storage_engine o tbl_collation en tbl_create.php."
}
],
"id": "CVE-2020-22452",
"lastModified": "2024-11-21T05:13:16.743",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-01-26T21:15:21.650",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://phpmyadmin.com"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/15898"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/pull/16004"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://phpmyadmin.com"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/blob/master/ChangeLog"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/issues/15898"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/pull/16004"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-07-16 18:41
Modified
2024-11-21 00:48
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "40B0D6C2-AF9E-4395-861D-64502D82589A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9C3663CE-AF25-4A0A-811E-DE58B7E5D934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F14B08F-6583-4686-B534-616D42B7D90B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "D4CD5425-79A4-4506-8BDA-299449EB51DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F754BBA9-765F-4BDE-9AF3-3DA4300B17C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "7A136E97-05EA-4ADF-82F5-E2D0C7737D6F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "53AE58C1-CB8C-415F-BF58-BD356D3AC000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDE752A-19A1-4910-9C56-0FDFFA367E30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre2:*:*:*:*:*:*:*",
"matchCriteriaId": "643C7F9B-B8C5-4C76-B706-F8CB5A800936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "701F99C8-D803-4D28-AFDA-B3DB5EBD5EEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A47F3385-8681-4A7D-BF64-8F6EA7FBDFE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6E3468-78AF-471C-A09E-1ACCC6867256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD740315-190A-43B7-8399-9B72FA592AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "794AE77E-843C-4CB4-9462-E4FE8C4C2896",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "E291BCAA-E2B5-4127-92DA-0BD48EACB6B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3B51601C-EDDC-41B7-82E9-EA4E7745F935",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "704C4359-A80E-456F-AA69-D188E4DFDBA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "DCE1E983-6EA4-4E0F-B7F8-B0070F8A3752",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7BD9F5E-B01D-4F1E-8BC2-F140ACF1472F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5DAB33AF-D8A9-444F-AC69-FACCFA0EEB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D1600D28-5583-4FA2-835F-BCE10813DB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "EAEA71B2-99EE-4975-A46B-A38112CD4F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "80AAD482-064D-4CFB-A1AE-49095036485A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "33423F75-0F5A-49F6-BF70-66DC2CE39E4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "6758F7AC-0FCF-4F6C-8F40-DDF1BA998AB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl4:*:*:*:*:*:*:*",
"matchCriteriaId": "CD3C5C9D-A802-40F3-B3CE-593CFED745CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D8FE9713-54BE-4A70-82F8-03B8E1915E2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0611660F-F060-453C-8BE2-1599FE3FF9BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2887738D-57A8-4E43-8498-5C8D0FAAA030",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "892F5D72-1814-48A5-8CCA-A74EE9D633CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "E25A359B-8FFD-4941-9419-4E99373D9588",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F79633E-19C0-4448-92F1-7C291C9CCD6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD9FD0D-2786-43BB-938B-A45D9B60E08E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "4D3CE1C3-59FF-457F-8579-996CA60CF6AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F2B3C2-0EDB-48D3-92BC-B1CA0E41F230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B64201-5B5B-4D22-B341-C601DC54BFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "B3130CFD-FF94-48D2-BF9A-D7FDD3CD6A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A217F2AE-185D-4385-8804-475DB12CFA0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the \"Creating a Database\" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection character set."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site request forgery (CSRF) en phpMyAdmin anterior a versi\u00f3n 2.11.7.1, permite a atacantes remotos realizar acciones no autorizadas por medio de un enlace o etiqueta IMG para (1) el par\u00e1metro db en la funcionalidad \"Creating a Database\" (en archivo db_create.php), y los par\u00e1metros (2) convcharset y collation_connection relacionados a un programa no especificado que modifica el ajuste de caracteres de conexi\u00f3n."
}
],
"id": "CVE-2008-3197",
"lastModified": "2024-11-21T00:48:40.650",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-07-16T18:41:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31097"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31115"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"url": "http://sourceforge.net/project/shownotes.php?release_id=613660"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2008/07/15/6"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2116/references"
},
{
"source": "cve@mitre.org",
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43846"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/project/shownotes.php?release_id=613660"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2008/07/15/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2116/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_ConvertCharset_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSRF_CreateDB_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43846"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00590.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00652.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. En la caracter\u00edstica de preferencia de interfaz de usuario, un usuario puede ejecutar un ataque de inyecci\u00f3n SQL contra la cuenta del usuario de control. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6619",
"lastModified": "2024-11-21T02:56:27.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:27.267",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/95048"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-42"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/95048"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-42"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-12-08 01:03
Modified
2024-11-21 00:03
Severity ?
Summary
The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.7.0_rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.7.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "FBD9FD0D-2786-43BB-938B-A45D9B60E08E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables."
}
],
"id": "CVE-2005-4079",
"lastModified": "2024-11-21T00:03:27.600",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-12-08T01:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17925/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17957"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/237"
},
{
"source": "cve@mitre.org",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/21508"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/418834/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15761"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/2792"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17925/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17957"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/18618"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/237"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/21508"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/418834/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/423142/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15761"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/2792"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-08-01 19:55
Modified
2024-11-21 01:28
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CCAB9FFF-8ED8-456F-8E46-C09152648E8B",
"versionEndIncluding": "3.3.10.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la vista de implementaci\u00f3n en la tabla Print en tbl_printview.php en phpMyAdmin anterior a v3.3.10.3 y v3.4.x anterior a v3.4.3.2 permite a usuarios autenticados de forma remota inyectar c\u00f3digo script web de su elecci\u00f3n o HTML a trav\u00e9s de un nombre de tabla manipulado."
}
],
"evaluatorImpact": "Per: http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php\r\n\r\n\u0027The attacker must trick the victim into clicking a link that reaches phpMyAdmin\u0027s table print view script; one of the link\u0027s parameters is a crafted table name (the name containing Javascript code).\u0027\r\n\r\n\u0027Mitigation factor\r\n\r\nThe crafted table name must exist (the attacker must have access to create a table on the victim\u0027s server).\u0027",
"id": "CVE-2011-2642",
"lastModified": "2024-11-21T01:28:40.170",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-08-01T19:55:01.337",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725381"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68750"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-9.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725381"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68750"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-30 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC60DE84-575A-4031-8B78-AD67C60595AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58D3F904-8C3C-46A5-A7A6-8EFA49648687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is improperly handled during rendering of the table browse page; a crafted ENUM value that is improperly handled during rendering of the (4) table print view or (5) zoom search page; or (6) a crafted pma_fontsize cookie that is improperly handled during rendering of the home page."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x anterior a 4.0.10.6, 4.1.x anterior a 4.1.14.7, y 4.2.x anterior a 4.2.12 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) una base de datos manipulada, (2) una tabla manipulada o (3) un nombre de columna manipulado que se maneja indebidamente durante el renderazaci\u00f3n de la p\u00e1gina del navegador de tablas; un valor ENUM manipulado que se maneja indebidamente durante la renderizaci\u00f3n de (4) la visualizaci\u00f3n de la impresi\u00f3n de tablas o (5) la p\u00e1gina de b\u00fasqueda del zoom; o (6) una cookie pma_fontsize manipulada que se maneja indebidamente durante la renderizaci\u00f3n de la p\u00e1gina de inicio."
}
],
"id": "CVE-2014-8958",
"lastModified": "2024-11-21T02:20:00.440",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-11-30T11:59:00.087",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71243"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/1bc04ec95038f2356ad33752090001bf1c047208"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2a3b7393d1d5a8ba0543699df94a08a0f5728fe0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2ffdbf2d7daa0b92541d8b754e2afac555d3ed21"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d32da348c4de2379482a48661ce968a55eebe5c4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/95732 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-6 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95732 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-6 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "18ADFF10-3935-419D-A5F2-589A702A857F",
"versionEndExcluding": "4.0.10.19",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "928D191C-A3A7-4DEE-87AF-CF2A03295798",
"versionEndIncluding": "4.4.15.10",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F21A70D3-CFF3-4A41-82BC-9EA2D7A190B6",
"versionEndIncluding": "4.6.6",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server"
},
{
"lang": "es",
"value": "phpMyAdmin versiones 4.0, 4.4 y 4.6 son vulnerables a una debilidad donde un usuario con los permisos adecuados puede conectarse a un servidor MySQL arbitrario."
}
],
"id": "CVE-2017-1000017",
"lastModified": "2024-11-21T03:03:58.737",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.483",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95732"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95732"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI."
},
{
"lang": "es",
"value": "phpMyAdmin 4.6.x en versiones anteriores a 4.6.3, cuando el entorno carece de valor PHP_SELF, permite a atacantes remotos llevar a cabo ataques de inyecci\u00f3n cookie-attribute a trav\u00e9s de una URI manipulada."
}
],
"id": "CVE-2016-5702",
"lastModified": "2024-11-21T02:54:51.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:13.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-18/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/27caf5b46bd0890e576fea7bd7b166a0639fdf68"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-18/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-03-26 14:30
Modified
2024-11-21 01:01
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "346DF9C7-40BE-44FD-BB5A-23F60616E97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B00F4D78-34C3-4934-8AFA-B7283388B246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BDA3305E-CBC2-4469-923F-29EDA0402CB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "40CE5E7C-A965-492F-AE85-535C3E5F1B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "52F3DA64-2099-4A4F-9F38-F28255F47BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D8CC1C1E-2B8C-4E59-B5ED-ED2957B46743",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EFCA67E-49E1-41FF-8B40-0209FF7893FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AE588389-7B4F-4949-BB7A-233C6BE31859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "4B9AA2E6-CF57-40A1-9A9C-B704D8B009F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE75CBB-4EC2-4B97-9E86-28BB05DEA30C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the export page (display_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allow remote attackers to inject arbitrary web script or HTML via the pma_db_filename_template cookie."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados - XSS - en la p\u00e1gina de exportaci\u00f3n (display_export.lib.php) en phpMyAdmin v2.11.x anteriores a v2.11.9.5 y v3.x anteriores a v3.1.3.1, permite a los atacantes remotos inyectar una secuencia de comandos web o HTML a trav\u00e9s de la cookie pma_db_filename_template."
}
],
"id": "CVE-2009-1150",
"lastModified": "2024-11-21T01:01:47.097",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-03-26T14:30:00.233",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34430"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34642"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35585"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35635"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/34251"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/trunk/phpMyAdmin/libraries/display_export.lib.php?r1=11986\u0026r2=12302\u0026pathrev=12302"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/34642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35585"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/35635"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200906-03.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2009/dsa-1824"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:115"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2009-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/34251"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:52
Severity ?
Summary
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94519 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-57 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94519 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-57 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 | |
| phpmyadmin | phpmyadmin | 4.0.4.2 | |
| phpmyadmin | phpmyadmin | 4.0.5 | |
| phpmyadmin | phpmyadmin | 4.0.6 | |
| phpmyadmin | phpmyadmin | 4.0.7 | |
| phpmyadmin | phpmyadmin | 4.0.8 | |
| phpmyadmin | phpmyadmin | 4.0.9 | |
| phpmyadmin | phpmyadmin | 4.0.10 | |
| phpmyadmin | phpmyadmin | 4.0.10.1 | |
| phpmyadmin | phpmyadmin | 4.0.10.2 | |
| phpmyadmin | phpmyadmin | 4.0.10.3 | |
| phpmyadmin | phpmyadmin | 4.0.10.4 | |
| phpmyadmin | phpmyadmin | 4.0.10.5 | |
| phpmyadmin | phpmyadmin | 4.0.10.6 | |
| phpmyadmin | phpmyadmin | 4.0.10.7 | |
| phpmyadmin | phpmyadmin | 4.0.10.8 | |
| phpmyadmin | phpmyadmin | 4.0.10.9 | |
| phpmyadmin | phpmyadmin | 4.0.10.10 | |
| phpmyadmin | phpmyadmin | 4.0.10.11 | |
| phpmyadmin | phpmyadmin | 4.0.10.12 | |
| phpmyadmin | phpmyadmin | 4.0.10.13 | |
| phpmyadmin | phpmyadmin | 4.0.10.14 | |
| phpmyadmin | phpmyadmin | 4.0.10.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user\u0027s valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario puede ser enga\u00f1ado a seguir un enlace que conduce a phpMyAdmin, lo que despu\u00e9s de la autenticaci\u00f3n redirige a otro sitio malicioso. El atacante debe escuchar el token phpMyAdmin v\u00e1lido del usuario. Todas las versiones 4.0.x (anteriores a 4.0.10.16) est\u00e1n afectadas."
}
],
"id": "CVE-2016-4412",
"lastModified": "2024-11-21T02:52:04.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:09.030",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94519"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-57"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-57"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message."
},
{
"lang": "es",
"value": "phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n manipulada, lo cual revela la ruta completa en un mensaje de error."
}
],
"id": "CVE-2016-2038",
"lastModified": "2024-11-21T02:47:39.773",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:01.157",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-1.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/447c88f4884fe30a25d38c331c31d820a19f8c93"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5aee5035646c4fc617564cb0d3d58c0435d64d81"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/76b10187c38634a29d6780f99f6dcd796191073b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/85ccdbb5b9c6c7a9830e5cb468662837a59a7aa3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d4b9c22c1f8465bda5b6a83dc7e2cf59c3fe44e1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/f83b52737e321005959497d8e8f59f8aaedc9048"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter."
},
{
"lang": "es",
"value": "js/get_scripts.js.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permite a atacantes remotos provocar una denegaci\u00f3n de servicio a trav\u00e9s de una gran variedad en el par\u00e1metro de secuencias de comandos."
}
],
"id": "CVE-2016-5706",
"lastModified": "2024-11-21T02:54:51.903",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:18.923",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91376"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-22/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91376"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4767f24ea4c1e3822ce71a636c341e8ad8d07aa6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-22/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-04-26 00:06
Modified
2024-11-21 00:10
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0.2 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 | |
| phpmyadmin | phpmyadmin | 2.8.1_dev | |
| phpmyadmin | phpmyadmin | 2.9.0_dev |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter."
}
],
"id": "CVE-2006-2031",
"lastModified": "2024-11-21T00:10:23.723",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2006-04-26T00:06:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25954"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://pridels0.blogspot.com/2006/04/phpmyadmin-xss-vuln.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://secunia.com/advisories/19659"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25954"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-08-01 19:55
Modified
2024-11-21 01:28
Severity ?
Summary
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E3E72232-C7D1-4D3E-97D1-5F3B89D447ED",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A24EBE-D760-4251-972E-86B71EC8A07D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505."
},
{
"lang": "es",
"value": "libraries/auth/swekey/swekey.auth.lib.php en phpMyAdmin v3.x anterior a v3.3.10.3 y v3.4.x anterior a v3.4.3.2 no maneja adecuadamente sesiones asociadas con autenticaci\u00f3n Swekey, lo que permite a atacantes remotos modificar el array superglobal SESSION, otros arrays superglobal y ciertas variables locales swekey.auth.lib.php a trav\u00e9s de consultas de cadenas manipuladas, relacionado con CVE-2011-2505."
}
],
"id": "CVE-2011-2719",
"lastModified": "2024-11-21T01:28:49.643",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-08-01T19:55:01.677",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "secalert@redhat.com",
"url": "http://osvdb.org/74112"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7"
},
{
"source": "secalert@redhat.com",
"url": "http://seclists.org/fulldisclosure/2011/Jul/300"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8322"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/518967/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/519155/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "secalert@redhat.com",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725384"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/74112"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=571cdc6ff4bf375871b594f4e06f8ad3159d1754"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=e7bb42c002885c2aca7aba4d431b8c63ae4de9b7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2011/Jul/300"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45365"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8322"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/25/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2011/07/26/10"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-12.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/518967/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/519155/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/48874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Conditional_Session_Manipulation.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=725384"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68769"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-26 03:34
Modified
2024-11-21 01:53
Severity ?
Summary
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\\x00 sequence, which is not properly handled before making a preg_replace function call within the \"Replace table prefix\" feature."
},
{
"lang": "es",
"value": "phpMyAdmin v3.5.x antes de v3.5.8 y v4.x antes de v4.0.0-RC3 permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario a trav\u00e9s de una secuencia /e\\x00, que no se utilizan con cuidado antes de hacer una llamada a la funci\u00f3n preg_replace en el \"Replace table prefix\"."
}
],
"id": "CVE-2013-3238",
"lastModified": "2024-11-21T01:53:14.783",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-04-26T03:34:23.440",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.exploit-db.com/exploits/25136"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66"
},
{
"source": "cve@mitre.org",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104725.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104770.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104936.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00181.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.exploit-db.com/exploits/25136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:160"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-2.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/dedd542cdaf1606ca9aa3f6f8f8adb078d8ad549"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/ffa720d90a79c1f33cf4c5a33403d09a67b42a66"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0133"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-02-20 01:59
Modified
2024-11-21 02:47
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*",
"matchCriteriaId": "253C303A-E577-4488-93E6-68A8DD942C38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*",
"matchCriteriaId": "E79AB8DD-C907-4038-A931-1A5A4CFB6A5B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A4D7AAF1-64FF-40C9-90B2-DEC814157372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "96D529F5-8870-4934-BCD8-E49095D21224",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "296EB2FA-FCAD-4BD5-A015-62765407AFE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4DBD0DC7-64D0-42B1-8EEE-73A0214680F5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A6A15D1E-83ED-47EC-B17C-E6BCC49DE83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4112ACFF-D40E-45BE-9307-F710E7B41ECD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) un nombre de tabla, (2) un valor SET, (3) una consulta de b\u00fasqueda o (4) un nombre de host en una cabecera Location."
}
],
"id": "CVE-2016-2040",
"lastModified": "2024-11-21T02:47:40.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-02-20T01:59:03.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00049.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2016-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/75a55824012406a08c4debf5ddb7ae41c32a7dbc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/aca42efa01917cc0fe8cfdb2927a6399ca1742f2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/edffb52884b09562490081c3b8666ef46c296418"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en la implementaci\u00f3n de partition-range en templates/table/structure/display_partitions.phtml en la p\u00e1gina table-structure en phpMyAdmin 4.6.x en versiones anteriores a 4.6.3 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una tabla de par\u00e1metros manipulada."
}
],
"id": "CVE-2016-5732",
"lastModified": "2024-11-21T02:54:54.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:22.627",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-25/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/0815af37f483f329f0c0565d68821fea9c47b5f5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/792cd1262f012b9b13639519d414f2acaeb5e972"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-25/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-19 14:29
Modified
2024-11-21 03:40
Severity ?
Summary
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/103936 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://www.securitytracker.com/id/1040752 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.exploit-db.com/exploits/44496/ | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-2/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/103936 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1040752 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/44496/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-2/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6BF51F82-F336-4A50-B99B-C3DF40950958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php."
},
{
"lang": "es",
"value": "phpMyAdmin 4.8.0 en versiones anteriores a la 4.8.0-1 tiene Cross-Site Request Forgery (CSRF), que permite que un atacante ejecute instrucciones SQL arbitrarias. Esto est\u00e1 relacionado con js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php y sql.php."
}
],
"id": "CVE-2018-10188",
"lastModified": "2024-11-21T03:40:58.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-19T14:29:00.480",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103936"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040752"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44496/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/103936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1040752"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44496/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://security.gentoo.org/glsa/201701-32 | ||
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/94527 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201701-32 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2016-63 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.4.0 | |
| phpmyadmin | phpmyadmin | 4.4.1 | |
| phpmyadmin | phpmyadmin | 4.4.1.1 | |
| phpmyadmin | phpmyadmin | 4.4.2 | |
| phpmyadmin | phpmyadmin | 4.4.3 | |
| phpmyadmin | phpmyadmin | 4.4.4 | |
| phpmyadmin | phpmyadmin | 4.4.5 | |
| phpmyadmin | phpmyadmin | 4.4.6 | |
| phpmyadmin | phpmyadmin | 4.4.6.1 | |
| phpmyadmin | phpmyadmin | 4.4.7 | |
| phpmyadmin | phpmyadmin | 4.4.8 | |
| phpmyadmin | phpmyadmin | 4.4.9 | |
| phpmyadmin | phpmyadmin | 4.4.10 | |
| phpmyadmin | phpmyadmin | 4.4.11 | |
| phpmyadmin | phpmyadmin | 4.4.12 | |
| phpmyadmin | phpmyadmin | 4.4.13 | |
| phpmyadmin | phpmyadmin | 4.4.13.1 | |
| phpmyadmin | phpmyadmin | 4.4.14 | |
| phpmyadmin | phpmyadmin | 4.4.14.1 | |
| phpmyadmin | phpmyadmin | 4.4.15 | |
| phpmyadmin | phpmyadmin | 4.4.15.1 | |
| phpmyadmin | phpmyadmin | 4.4.15.2 | |
| phpmyadmin | phpmyadmin | 4.4.15.3 | |
| phpmyadmin | phpmyadmin | 4.4.15.4 | |
| phpmyadmin | phpmyadmin | 4.4.15.5 | |
| phpmyadmin | phpmyadmin | 4.4.15.6 | |
| phpmyadmin | phpmyadmin | 4.4.15.7 | |
| phpmyadmin | phpmyadmin | 4.4.15.8 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Llamando a algunas secuencias de comandos que son parte de phpMyAdmin de forma inesperada, es posible desencadenar phpMyAdmin para mostrar un mensaje de error de PHP que contiene la ruta completa del directorio donde phpMyAdmin est\u00e1 instalado. Durante un tiempo de espera de ejecuci\u00f3n en la funcionalidad de exportaci\u00f3n, los errores que contienen la ruta completa del directorio de phpMyAdmin se escriben en el archivo de exportaci\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) est\u00e1n afectadas. Esta CVE es para el problema json_decode."
}
],
"id": "CVE-2016-9854",
"lastModified": "2024-11-21T03:01:53.293",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:52.850",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-07-14 23:55
Modified
2024-11-21 01:28
Severity ?
Summary
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1FE65F49-CDED-49B0-89F4-CE52E357069A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4B29D2E6-F327-4B19-B33F-E888F8B81E7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7C579327-8F92-41AF-926A-86442063A83D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8C3F84C4-883B-48DC-9181-E54A87DC973B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C10C216-594B-4F08-B86E-A476A452189B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2A3CED16-3ECE-49F6-A52B-0222B14DBC88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4938BCE-1365-469A-B714-A5D9C451FA20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "35F46942-E054-43E4-9543-E126738845E2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array."
},
{
"lang": "es",
"value": "setup/lib/ConfigGenerator.class.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 no restringe correctamente la presencia de los delimitadores de cierre de comentario, permitiendo a atacantes remotos realizar ataques de inyecci\u00f3n de c\u00f3digo est\u00e1tico mediante la modificaci\u00f3n del array superglobal SESI\u00d3N."
}
],
"id": "CVE-2011-2506",
"lastModified": "2024-11-21T01:28:25.397",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-07-14T23:55:04.880",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "secalert@redhat.com",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "secalert@redhat.com",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/73612"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "secalert@redhat.com",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062719.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0fbedaf5fd7a771d0885c6b7385d934fc90d0d7f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45292"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/45315"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/8306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2286"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.exploit-db.com/exploits/17514/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/28/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/29/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/73612"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/518804/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-01-10 05:00
Modified
2024-11-20 23:50
Severity ?
Summary
phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.4.0 | |
| phpmyadmin | phpmyadmin | 2.5.0 | |
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 | |
| phpmyadmin | phpmyadmin | 2.5.6_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.7 | |
| phpmyadmin | phpmyadmin | 2.5.7_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl1 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl2 | |
| phpmyadmin | phpmyadmin | 2.6.0_pl3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C2D276-CFA3-40CB-AEAF-C641BAD4EB61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DF345665-3C1D-4F44-B648-B695D88267BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "99FD7D45-135D-4AE7-83E0-FDFE436DFE4E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C3F2E1-FEFC-4C04-B337-7AC3E38AE430",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl2:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C525B9-636F-49B9-B528-50AEB0E98F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFB3EBBF-E696-48D1-B3BA-B3C88C050F12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters."
}
],
"id": "CVE-2004-1147",
"lastModified": "2024-11-20T23:50:13.007",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-01-10T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=110295781828323\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.exaprobe.com/labs/advisories/esa-2004-1213.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18441"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the \"Remove partitioning\" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected."
},
{
"lang": "es",
"value": "Se descubrieron problemas de XSS en phpMyAdmin. Esto afecta a la comprobaci\u00f3n de privilegios de la base de datos y a la funcionalidad \"Eliminar particiones\". Los nombres de base de datos especialmente manipulados pueden desencadenar el ataque XSS. Todas las versiones 4.6.x (anteriores a 4.6.4) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6608",
"lastModified": "2024-11-21T02:56:26.097",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:12.970",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/93258"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-31"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/93258"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-31"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-31 13:20
Modified
2024-11-21 01:56
Severity ?
Summary
Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.5.0.0 | |
| phpmyadmin | phpmyadmin | 3.5.1.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.0 | |
| phpmyadmin | phpmyadmin | 3.5.2.1 | |
| phpmyadmin | phpmyadmin | 3.5.2.2 | |
| phpmyadmin | phpmyadmin | 3.5.3.0 | |
| phpmyadmin | phpmyadmin | 3.5.4 | |
| phpmyadmin | phpmyadmin | 3.5.5 | |
| phpmyadmin | phpmyadmin | 3.5.6 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.7 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8 | |
| phpmyadmin | phpmyadmin | 3.5.8.1 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 | |
| phpmyadmin | phpmyadmin | 4.0.3 | |
| phpmyadmin | phpmyadmin | 4.0.4 | |
| phpmyadmin | phpmyadmin | 4.0.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2577DB75-9893-4496-B9B8-22F4D7C70D8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3BBC76AB-567B-4081-8520-D4BB2211CA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EDFD7186-12C3-4FA6-951E-288063262EAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C4E23EA5-8FD8-441A-8CB6-F1E77AA0D73B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B5FE1328-F2E1-45C8-80ED-0560DAB666EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC675B47-0373-442E-9BCD-35D79355073C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "96E2C613-B1E9-4DB5-AA7D-165E5093452F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0E7188-E3DE-4A9C-9B9B-31E7276F74AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3E6D5B72-CA57-4054-B002-56C03856D740",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:*:*:*:*:*:*:*",
"matchCriteriaId": "71325EEA-441A-4D04-85E1-B7627C15ECE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EE098CE1-0FA0-48C0-8F9F-CC9150E96C40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C6CBB65B-F6F8-4B5C-9782-4ECCEAB756E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "56245F7F-C483-42C1-9D30-AA39C3441591",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.5.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "022DB5CB-E815-484A-BA40-2267E864D825",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente ejecutar comandos SQL arbitrarios a trav\u00e9s de (1)el par\u00e1metro \"scale\" a pmd_pdf.php o (2) el par\u00e1metro pdf_page_number a schema_export.php."
}
],
"id": "CVE-2013-5003",
"lastModified": "2024-11-21T01:56:52.890",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-31T13:20:08.670",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/61923"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59832"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-15.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/61923"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-01-26 17:29
Modified
2024-11-21 04:47
Severity ?
Summary
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/106736 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2019-1/ | Mitigation, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106736 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2019-1/ | Mitigation, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E29381E7-0E75-4B66-B2BD-30C8C1F2C499",
"versionEndIncluding": "4.8.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server\u0027s user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of \"options(MYSQLI_OPT_LOCAL_INFILE\" calls."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Cuando el ajuste de configuraci\u00f3n \"AllowArbitraryServer\" se establece en \"true\" con el uso de un servidor MySQL no autorizado, un atacante puede leer cualquier archivo en el servidor que sea accesible por cualquier usuario del servido web. Esto est\u00e1 relacionado con la configuraci\u00f3n PHP mysql.allow_local_infile y la omisi\u00f3n inadvertida de llamadas \"options(MYSQLI_OPT_LOCAL_INFILE\"."
}
],
"id": "CVE-2019-6799",
"lastModified": "2024-11-21T04:47:10.920",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-01-26T17:29:00.450",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106736"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106736"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2019-1/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-12-17 19:00
Modified
2024-11-21 01:21
Severity ?
Summary
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C47D37FF-66B5-4105-80D6-F66F772F498A",
"versionEndIncluding": "3.3.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "600327B4-A072-4BDF-97CF-AFAFC4B508DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE1361B-D70B-45B9-BD2F-7C049D96928A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "06EE0CCB-559F-457B-A1EC-79D0680DCDD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "00826A60-50A4-4E05-B317-8D0A5FC637BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7AC1AECC-6521-4D9D-88D5-86DA8BDB1D26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "79093150-F515-42D9-AEF2-86C0C4B1B8AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function."
},
{
"lang": "es",
"value": "phpMyAdmin anteriores a v3.4.0-beta1, permite a atacantes remotos evitar la autenticaci\u00f3n y obtener informaci\u00f3n sensible a trav\u00e9s de una solicitud directa al phpinfo.php, que llama a la funci\u00f3n phpinfo."
}
],
"id": "CVE-2010-4481",
"lastModified": "2024-11-21T01:21:02.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-12-17T19:00:23.747",
"references": [
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42485"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42725"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3238"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42485"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/42725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2139"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:000"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/3238"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2011/0027"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-08-24 20:00
Modified
2024-11-21 01:17
Severity ?
Summary
The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.0 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.0 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3.0 | |
| phpmyadmin | phpmyadmin | 2.11.4.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.0 | |
| phpmyadmin | phpmyadmin | 2.11.5.1 | |
| phpmyadmin | phpmyadmin | 2.11.5.2 | |
| phpmyadmin | phpmyadmin | 2.11.6.0 | |
| phpmyadmin | phpmyadmin | 2.11.7.0 | |
| phpmyadmin | phpmyadmin | 2.11.7.1 | |
| phpmyadmin | phpmyadmin | 2.11.8.0 | |
| phpmyadmin | phpmyadmin | 2.11.9.0 | |
| phpmyadmin | phpmyadmin | 2.11.9.1 | |
| phpmyadmin | phpmyadmin | 2.11.9.2 | |
| phpmyadmin | phpmyadmin | 2.11.9.3 | |
| phpmyadmin | phpmyadmin | 2.11.9.4 | |
| phpmyadmin | phpmyadmin | 2.11.9.5 | |
| phpmyadmin | phpmyadmin | 2.11.9.6 | |
| phpmyadmin | phpmyadmin | 2.11.10.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request."
},
{
"lang": "es",
"value": "La configuraci\u00f3n de la secuencia de comandos de instalaci\u00f3n (tambi\u00e9n conocida como scripts/setup.php) en phpMyAdmin v2.11.x anterior a v2.11.10.1 no restringe adecuadamente nombres clave en sus archivos de salida, lo que permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de una petici\u00f3n POST manipulada."
}
],
"id": "CVE-2010-3055",
"lastModified": "2024-11-21T01:17:56.663",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-08-24T20:00:01.113",
"references": [
{
"source": "cve@mitre.org",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41058"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41185"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/42591"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=30c83acddb58d3bbf940b5f9ec28abf5b235f4d2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41058"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://sourceforge.net/tracker/?func=detail\u0026aid=3045132\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/42591"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2231"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 02:56
Severity ?
Summary
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Un usuario puede explotar la funcionalidad LOAD LOCAL INFILE para exponer los archivos del servidor al sistema de base de datos. Todas las versiones 4.6.x (anteriores a 4.6.4), versiones 4.4.x (anteriores a 4.4.15.8) y versiones 4.0.x (anteriores a 4.0.10.17) est\u00e1n afectadas."
}
],
"id": "CVE-2016-6612",
"lastModified": "2024-11-21T02:56:26.737",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:18.470",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94113"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-35"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94113"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-35"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-08-04 19:41
Modified
2024-11-21 00:49
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CCE0DD38-2444-4E7C-86BB-B1650DFB0C7D",
"versionEndIncluding": "2.11.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "784EF815-B20A-4D26-8FCA-04BCBAD65BDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "91ABFE90-9D9D-40FD-A2ED-A7021DFCC301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E6C869A-0307-40D9-85D6-05453B6BEA35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.01:*:*:*:*:*:*:*",
"matchCriteriaId": "65D9D3A9-CC69-40B7-9FBF-9A18A4342FB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "37C15B2C-D4A9-4946-8EB9-B6C131D6E8D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "795B4F23-BA5E-466B-9FC3-C7A00A110774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F099-04AC-4210-8477-07B21E087162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "962B49A9-380D-4B19-929B-50793EF621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DE432385-9FC2-4EB3-9770-4CA9A2979019",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en setup.php de phpMyAdmin versiones anteriores a 2.11.8 permite a atacantes remotos asistidos por el usuario inyectar web script o HTML de su elecci\u00f3n a trav\u00e9s de argumentos de instalaci\u00f3n manipulados.\r\nNOTA: esta cuesti\u00f3n s\u00f3lo puede ser explotada en escenarios limitados en los cuales el atacante puede modificar config/config.inc.php."
}
],
"id": "CVE-2008-3457",
"lastModified": "2024-11-21T00:49:18.307",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-08-04T19:41:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31263"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/31312"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32834"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44052"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"source": "cve@mitre.org",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31263"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/31312"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1641"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:202"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/30420"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2226/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/XSS_inPhpMyAdmin2.11.7.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01239.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01316.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 02:59
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg[\u0027Servers\u0027][$i][\u0027AllowRoot\u0027]) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Es posible eludir la restricci\u00f3n AllowRoot ($cfg[\u0027Servers\u0027][$i][\u0027AllowRoot\u0027]) y denegar reglas para nombres de usuario usando Null Byte en el nombre de usuario. Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9849",
"lastModified": "2024-11-21T03:01:52.503",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T02:59:47.083",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94521"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-60"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/94521"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-60"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 | |
| phpmyadmin | phpmyadmin | 4.6.3 | |
| phpmyadmin | phpmyadmin | 4.6.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Con una solicitud de inicio de sesi\u00f3n manipulada es posible inyectar BBCode en la p\u00e1gina de inicio de sesi\u00f3n. Todas las versiones 4.6.x (anteriores a 4.6.5) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9862",
"lastModified": "2024-11-21T03:01:54.537",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:03.197",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94528"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-67"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-67"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-11 17:29
Modified
2024-11-21 03:58
Severity ?
Summary
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/106181 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2018-8/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/106181 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201904-16 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2018-8/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E1ED0CAE-0B60-4038-8F53-5C01551867C1",
"versionEndExcluding": "4.8.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name."
},
{
"lang": "es",
"value": "En phpMyAdmin, en versiones anteriores a la 4.8.4, se ha encontrado una vulnerabilidad Cross-Site Scripting (XSS) en el \u00e1rbol de navegaci\u00f3n, donde un atacante puede entregar una carga \u00fatil a un usuario mediante un nombre de base de datos/tabla manipulado."
}
],
"id": "CVE-2018-19970",
"lastModified": "2024-11-21T03:58:54.913",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-11T17:29:00.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106181"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106181"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/201904-16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2018-8/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-18 02:28
Modified
2024-11-21 00:25
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin 2.8.1 y anteriores, al usar Microsoft Internet Explorer 6, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante un URI del tipo javascript: en un estilo CSS en el par\u00e1metro convcharset al URI de nivel superior, una vulnerabilidad diferente que CVE-2005-0992."
}
],
"id": "CVE-2007-0341",
"lastModified": "2024-11-21T00:25:37.253",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-18T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/456698/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/456726/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.virtuax.be/advisories/Advisory1-12012007.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/456698/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/456726/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.virtuax.be/advisories/Advisory1-12012007.txt"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-20 11:12
Modified
2024-11-21 02:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.2.0 | |
| phpmyadmin | phpmyadmin | 4.2.1 | |
| phpmyadmin | phpmyadmin | 4.2.2 | |
| phpmyadmin | phpmyadmin | 4.2.3 | |
| phpmyadmin | phpmyadmin | 4.2.4 | |
| phpmyadmin | phpmyadmin | 4.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la funci\u00f3n PMA_getHtmlForActionLinks en libraries/structure.lib.php en phpMyAdmin 4.2.x anterior a 4.2.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un comentario de tabla manipulado que se maneja indebidamente durante la construcci\u00f3n de una p\u00e1gina de estructura de la base de datos."
}
],
"id": "CVE-2014-4954",
"lastModified": "2024-11-21T02:11:10.080",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-07-20T11:12:51.150",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68798"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68798"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/57475371a5b515c83bfc1bb2efcdf3ddb14787ed"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-08-24 20:00
Modified
2024-11-21 01:17
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC82C85-C9CF-424D-A07A-E841F7AC1904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "34AB221E-3DFA-43E4-9DBA-5565F81C0120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F8AAB78-8460-43BB-9326-0395F7496EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3329598B-BEA5-4119-A558-DAA432239A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EA5BCF7D-43FC-459C-8564-F0DCDC301FC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA6A75C9-C695-45DF-9526-8DEA506FB21F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03246EF4-F805-4C1C-9E6C-D85AFBD2D168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0AF4BA83-50C0-4D90-9755-CC99A0FF987E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E709A6B-B580-414B-8CEE-8FF99F8409C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3B9AD02-9D59-42D5-8886-A053219EE5F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1648F2C4-40C6-438B-86B0-2D1E37C78B45",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A26E7D37-FA99-42EA-8E19-ED2343E8E70A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A982E152-5A20-4A3A-9A98-6CF9EEF9141A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FFA11353-1DD1-4593-84E8-1D3CBB2C2166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0C19FB-60DF-440F-9A32-B9C62EBA9836",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9716FC40-F759-4D24-9604-7A2DB32A8F42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "399A4EF5-FBDC-4856-89A5-821011E5E7E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.9.6:*:*:*:*:*:*:*",
"matchCriteriaId": "4834A26C-C0FD-4D8D-9385-8022D3F4BF44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "909FDD04-9A4D-42F6-B9C7-0A6262D04492",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7ED38B88-A4D2-40B4-A5A8-A9FD1BCAAF8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:alpha:*:*:*:*:*:*",
"matchCriteriaId": "5E5D29CC-12CE-43D3-A135-C148542E5AAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "BAF28FF5-6FF5-47D8-BEB9-D54E58C0740F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "613C697A-7CFF-4529-BD15-0ED4B753527A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "56908EFC-CCA8-4B22-8F8F-FB23C934D6E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "82DFC89B-F989-41C5-87E2-11A259E7F5C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F21917E9-A820-4A5F-B38B-E3E0F79A380C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "400E2D41-CB1F-4E5C-B08D-35294F8D1402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "16247466-32B5-4632-9F4E-92A70ED9604D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4AFEEBA-01BA-46D6-86A3-B1B5A8F1B5FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3F72014B-B168-4FFA-ADDC-86CE84D19681",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AFFE8553-D8FF-4BA3-9325-A3C366FDFBEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "72CD1784-3F48-49B5-A154-61C1F7EC3F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "CAAA1171-F570-4E4D-B667-2D4C8F8ECDD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "278B4EF3-4331-4334-AB55-EC05C069F48A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4943CF80-91E5-42CD-BD51-6CAFC83EA5A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D0284F72-2126-4BE8-90CA-82D2E4B3E96D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C24AEFB1-7070-4F9B-BCDA-60F33C17D536",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E8D735F4-165E-45C9-BF3B-9B618A8E3720",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "62E60F6F-C855-45BF-8840-398FA62626EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F4EDCE1E-436A-4369-A734-7D620F5D89B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98051D18-43E3-47D6-A8D4-AD9F0C8B0A7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B468BEA-022D-48A9-8E52-31D78F28E871",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "78BC489B-E02E-4C6E-9EA1-EDC926EBA5BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BDCB1657-8C8F-44FE-8C1D-BF191DE70657",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35F44A77-1169-4A0D-8864-EB7AF56324AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE0CFF97-8F8B-405D-BA59-B88C1C07A4C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BA3C0B46-3964-4A22-9AD4-4F4C8B4B4790",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "84100813-C889-4DB0-8D86-E78A047B7C7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B99F558E-F696-467D-8C8B-5CFFED2A95D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "85BA84E5-8631-478C-8229-CFF36F61569A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77430AB8-6EAA-4C99-9700-E5015F8D56FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8CFADB43-A63B-4A58-9A9D-232B0CA3F9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.3.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "89FC756B-8CF7-4F57-A6AA-8C074F14BCA0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.11.x before 2.11.10.1 and 3.x before 3.3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, and (17) tbl_sql.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin v2.11.x anterior a v2.11.10.1, y 3.x anterior a 3.3.5.1 permite a atacantes remotos inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9s de vectores relacionados con (1) db_search.php, (2) db_sql.php, (3) db_structure.php, (4) js/messages.php, (5) libraries/common.lib.php, (6) libraries/database_interface.lib.php, (7) libraries/dbi/mysql.dbi.lib.php, (8) libraries/dbi/mysqli.dbi.lib.php, (9) libraries/db_info.inc.php, (10) libraries/sanitizing.lib.php, (11) libraries/sqlparser.lib.php, (12) server_databases.php, (13) server_privileges.php, (14) setup/config.php, (15) sql.php, (16) tbl_replace.php, y (17) tbl_sql.php."
}
],
"id": "CVE-2010-3056",
"lastModified": "2024-11-21T01:17:56.827",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-08-24T20:00:02.097",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41000"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41185"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:164"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/42584"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=625877"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045991.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045997.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41000"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/41185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2010/dsa-2097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:163"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:164"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-5.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/42584"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2010/2223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/2231"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://yehg.net/lab/pr0js/advisories/phpmyadmin/%5Bphpmyadmin-3.3.5%5D_cross_site_scripting%28XSS%29"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=625877"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-17 13:18
Modified
2024-11-21 03:03
Severity ?
Summary
phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/95726 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-4 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95726 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-4 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.18:*:*:*:*:*:*:*",
"matchCriteriaId": "B90D111A-A076-4936-BA7F-E2C3ACE44B8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.9:*:*:*:*:*:*:*",
"matchCriteriaId": "09D97993-070A-4D32-B560-38AF28C87A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "33130418-95AC-41D2-B8B0-A107C9CABCFB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters"
},
{
"lang": "es",
"value": "phpMyAdmin en las versiones 4.0, 4.4 y 4.6 es vulnerable a un ataque de inyecci\u00f3n de tipo CSS por medio de par\u00e1metros cookies creados."
}
],
"id": "CVE-2017-1000015",
"lastModified": "2024-11-21T03:03:58.433",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-17T13:18:16.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95726"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95726"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-4"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-07-04 14:33
Modified
2024-11-21 01:54
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.0 | |
| phpmyadmin | phpmyadmin | 4.0.1 | |
| phpmyadmin | phpmyadmin | 4.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3nd de secuencias de comandos en sitios cruzados (XSS) en view_create.php (tambi\u00e9n conocido como la p\u00e1gina Create View) en phpMyAdmin v4.x antes de v4.0.3 permite a usuarios remotos autenticados inyectar secuencias de comandos Web o HTML a trav\u00e9s de estados SQL CREATE VIEW inv\u00e1lidos con nombre manipulados que dispara mensajes de error."
}
],
"id": "CVE-2013-3742",
"lastModified": "2024-11-21T01:54:12.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-07-04T14:33:41.650",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/9b3551601ce714adb5e3f428476052f0ec6093bf"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-08-22 01:55
Modified
2024-11-21 02:11
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js; (4) query charts page, related to js/tbl_chart.js; or (5) table relations page, related to libraries/tbl_relation.lib.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x anterior a 4.0.10.2, 4.1.x anterior a 4.1.14.3, y 4.2.x anterior a 4.2.7.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de (1) la p\u00e1gina de las tablas de navegaci\u00f3n, relacionado con js/sql.js; (2) la p\u00e1gina del editor ENUM, relacionado con js/functions.js; (3) la p\u00e1gina de monitorizaci\u00f3n, relacionado con js/server_status_monitor.js; (4) la p\u00e1gina de la consulta de gr\u00e1ficos, relacionado con js/tbl_chart.js; o (5) la p\u00e1gina de las relaciones de tablas, relacionado con libraries/tbl_relation.lib.php."
}
],
"id": "CVE-2014-5273",
"lastModified": "2024-11-21T02:11:45.747",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-08-22T01:55:08.717",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00045.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/60397"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-8.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/2c45d7caa614afd71dbe3d0f7270f51ce5569614"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/3ffc967fb60cf2910cc2f571017e977558c67821"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/647c9d12e33a6b64e1c3ff7487f72696bdf2dccb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/90ddeecf60fc029608b972e490b735f3a65ed0cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd9f302bf7f91a160fe7080f9a612019ef847f1c"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-05-26 15:59
Modified
2024-11-21 02:30
Severity ?
Summary
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E5BF910D-87F7-4FF5-ACA0-1FCEEF4DD741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFF14-5C5A-4858-97A2-1208278D916E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "B6360AD1-B295-4123-A6AC-99B13FA12C1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CA9A5D9E-EF89-4F0B-8DA2-B54DAB5616BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AEE79B8B-2B53-44A9-B5A2-233A43149448",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1F6AA505-40A6-4767-A848-3B00EA8EDD7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "347983D5-CB40-44C9-8C68-10A8417F4BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "16C9023A-2E9A-4DDA-84A8-D6E2A4F1019F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "564261EC-AEA3-4BDD-9E7D-56B29628D16F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2154D6EC-C492-4035-B5E6-9A5BAB2F2164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "819ECCB5-C0D7-47D0-8479-2C36734F47B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "3499F9A7-3F4E-4AD3-94FB-242FD135B851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "53CFCBBC-E941-4167-A474-7C88F6C489AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "CE374D7A-90E3-42A1-A02A-88B03AB70605",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2088A96D-C4C6-4FA9-8594-3DAA81D48443",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C0F02404-0D50-4222-B24D-6D5E34A6E60F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "254D4A65-99B4-4594-8929-1D0481DB170B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D679D05B-58B9-4089-B002-F60646D6283F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.3.13:*:*:*:*:*:*:*",
"matchCriteriaId": "588D87F7-2F0E-4912-B81A-7A7C6642B1AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
},
{
"lang": "es",
"value": "libraries/Config.class.php en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 deshabilita la verificaci\u00f3n de los certificados X.509 para las llamadas de API GitHub sobre SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener informaci\u00f3n sensible a trav\u00e9s de un certificado manipulado."
}
],
"id": "CVE-2015-3903",
"lastModified": "2024-11-21T02:30:03.460",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2015-05-26T15:59:11.447",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://cxsecurity.com/issue/WLB-2015050095"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/535547/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/74660"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1032403"
},
{
"source": "cve@mitre.org",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://cxsecurity.com/issue/WLB-2015050095"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2015/dsa-3382"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/535547/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/74660"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1032403"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5ebc4daf131dd3bd646326267f3e765d0249bbb4"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-03-03 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.0 | |
| phpmyadmin | phpmyadmin | 2.0.1 | |
| phpmyadmin | phpmyadmin | 2.0.2 | |
| phpmyadmin | phpmyadmin | 2.0.3 | |
| phpmyadmin | phpmyadmin | 2.0.4 | |
| phpmyadmin | phpmyadmin | 2.0.5 | |
| phpmyadmin | phpmyadmin | 2.1 | |
| phpmyadmin | phpmyadmin | 2.1.1 | |
| phpmyadmin | phpmyadmin | 2.1.2 | |
| phpmyadmin | phpmyadmin | 2.2.2 | |
| phpmyadmin | phpmyadmin | 2.2.3 | |
| phpmyadmin | phpmyadmin | 2.2.4 | |
| phpmyadmin | phpmyadmin | 2.2.5 | |
| phpmyadmin | phpmyadmin | 2.2.6 | |
| phpmyadmin | phpmyadmin | 2.2_pre1 | |
| phpmyadmin | phpmyadmin | 2.2_rc1 | |
| phpmyadmin | phpmyadmin | 2.2_rc2 | |
| phpmyadmin | phpmyadmin | 2.2_rc3 | |
| phpmyadmin | phpmyadmin | 2.3.1 | |
| phpmyadmin | phpmyadmin | 2.3.2 | |
| phpmyadmin | phpmyadmin | 2.4.0 | |
| phpmyadmin | phpmyadmin | 2.5.0 | |
| phpmyadmin | phpmyadmin | 2.5.1 | |
| phpmyadmin | phpmyadmin | 2.5.2 | |
| phpmyadmin | phpmyadmin | 2.5.4 | |
| phpmyadmin | phpmyadmin | 2.5.5 | |
| phpmyadmin | phpmyadmin | 2.5.5_pl1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc1 | |
| phpmyadmin | phpmyadmin | 2.5.5_rc2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61A423F0-91C8-48C9-A6B1-46DBB1A31DC1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "59384A5A-F530-4417-8AFB-005EE4A54A44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "85CFC048-C7C5-47E6-A7E9-E1ED99142493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "120A58AE-69B7-426D-947D-9C0D9D9CE1E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8E1CEFBE-9194-4350-9F81-2EA6EDF52AEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "980AC0DB-2759-49D3-8347-C119AFFF8DBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABC8407-173D-466B-B366-5F7F5D9F2F14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D2743D-5B67-4D6A-9A03-FCF9EA4534A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C2535BF-A7BE-40DD-9582-0DE66B8FDC2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F666B78D-5DC9-4256-8A23-A4021AE7044A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "096B01B4-3CD4-4CB4-8528-D1DB0D0BFB44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "229DE8B7-489B-4848-B1BE-2339CB771573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "D9BC58E6-CA26-4760-A6A4-D65184A50539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "ACE7C97E-60C6-417F-86F7-963ADE52A895",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_pre1:*:*:*:*:*:*:*",
"matchCriteriaId": "3FF189AE-9485-4F8C-AAAE-25088DF6F964",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "560BC57D-BDCE-4479-9847-6DB53A89FFD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "4859644F-E5FF-4AE4-B16D-CC2243964D81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2_rc3:*:*:*:*:*:*:*",
"matchCriteriaId": "FD44FE0C-C9A5-4B2E-AE71-CFDE406DCA6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3DE653E-E7FF-4DE0-A7C8-CC86C95550F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "48888218-B238-4F0D-A4C2-E9877D3F3A4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A393256A-A5BE-4467-8058-E9CA5D626D59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1B9C4839-2356-4630-BDB3-4A0171F3A785",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "22C55462-6370-45B3-8F00-50F4502981F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "18BBE005-1FEC-4178-A6A0-CAAB148948F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2E7577-5F89-4B2C-9C28-A5268B539968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5:*:*:*:*:*:*:*",
"matchCriteriaId": "929F5CD6-51F3-42CF-8BA8-579120DD835D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"matchCriteriaId": "0F86B56F-510F-4C6F-A259-6200DC2B05ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "92B58A87-7A30-494D-9A9A-AF9FE6E59600",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "F56E2F91-DC93-4FF0-AFF2-DBB5E13B467D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de atravesamiento de directorios en export.php en phpMyAdmin 2.5.5 y anteriores permite a atacantes remotos leer ficheros arbitrarios mediante secuencias .. (punto punto) en el par\u00e1metro what"
}
],
"id": "CVE-2004-0129",
"lastModified": "2024-11-20T23:47:50.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-03-03T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=107582619125932\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/10769"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200402-05.xml"
},
{
"source": "cve@mitre.org",
"url": "http://sourceforge.net/forum/forum.php?forum_id=350228"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3800"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9564"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15021"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=107582619125932\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/10769"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://security.gentoo.org/glsa/glsa-200402-05.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sourceforge.net/forum/forum.php?forum_id=350228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/relnotes.php?rel=0"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9564"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15021"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-04-23 16:05
Modified
2024-11-21 00:45
Severity ?
Summary
Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 2.10.0 | |
| phpmyadmin | phpmyadmin | 2.10.0.1 | |
| phpmyadmin | phpmyadmin | 2.10.0.2 | |
| phpmyadmin | phpmyadmin | 2.10.1 | |
| phpmyadmin | phpmyadmin | 2.10.2 | |
| phpmyadmin | phpmyadmin | 2.10.3 | |
| phpmyadmin | phpmyadmin | 2.10.3rc1 | |
| phpmyadmin | phpmyadmin | 2.11.0 | |
| phpmyadmin | phpmyadmin | 2.11.0beta1 | |
| phpmyadmin | phpmyadmin | 2.11.0rc1 | |
| phpmyadmin | phpmyadmin | 2.11.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.1 | |
| phpmyadmin | phpmyadmin | 2.11.1.2 | |
| phpmyadmin | phpmyadmin | 2.11.1rc1 | |
| phpmyadmin | phpmyadmin | 2.11.2 | |
| phpmyadmin | phpmyadmin | 2.11.2.1 | |
| phpmyadmin | phpmyadmin | 2.11.2.2 | |
| phpmyadmin | phpmyadmin | 2.11.3 | |
| phpmyadmin | phpmyadmin | 2.11.3rc1 | |
| phpmyadmin | phpmyadmin | 2.11.4 | |
| phpmyadmin | phpmyadmin | 2.11.4rc1 | |
| phpmyadmin | phpmyadmin | 2.11.5 | |
| phpmyadmin | phpmyadmin | 2.11.6rc1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DC18B1C0-5228-4A30-8275-569C026F8070",
"versionEndIncluding": "2.11.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CAA8D87A-D161-4CC4-8E71-FD2407EA247E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CABB8831-0951-4E3B-B983-FC390A622FEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BEE37166-AC6C-473A-8266-38417C6F2167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CAC01AB6-A640-45FF-8971-593A49AD3694",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "439ED5A5-7720-4FB4-AFE9-D6F2625D98D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F57B4C9F-FF70-44D4-9577-FE6C4BC69828",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.10.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "D86CCE3D-61C1-4A9D-8A54-3D14B9C5BCBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A98FF47C-8BA8-40E1-98F5-743CAD5DC52A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "AEC66C23-0133-4A39-B8C0-BCFF6F1E4D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.0rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "8F3A44D6-F174-428E-8456-5B7B093D7A64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B9F52BC-AC6A-41BB-8276-6176FA068929",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0549FC5-B8E8-455D-867B-BAF321DE7004",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "01DA6D40-2D3A-4490-B4E6-1367C585ED9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.1rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "EF6D9CF4-C9D6-4CDE-86F4-BA46913CE8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9E351CA2-71DB-4025-8477-24DFE5349195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCB774D1-8B5D-4118-8A5B-D7D14D7DE162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6C10F7C9-FAAA-4D05-8CB2-F5CB397F8410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "54669C6E-C13B-4602-9CC1-53B24CB897FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.3rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD5CB748-A953-4CAD-B8F9-21F43D2992E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2909BBB8-AB67-45DC-BAF0-015CBF97AFD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.4rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "A4843917-B7B1-4871-AE2B-2219C6EB85F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "80E1F897-861F-4E10-8E05-3C0DD60C7979",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.11.6rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC99B93D-2171-40DE-90B3-61D6DB9F6D47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in phpMyAdmin before 2.11.5.2, when running on shared hosts, allows remote authenticated users with CREATE table permissions to read arbitrary files via a crafted HTTP POST request, related to use of an undefined UploadDir variable."
},
{
"lang": "es",
"value": "Una vulnerabilidad no especificada en phpMyAdmin versiones anteriores a 2.11.5.2, cuando se ejecuta en hosts compartidos, permite a los usuarios autenticados remotos con permisos de tabla CREATE leer archivos arbitrarios por medio de una petici\u00f3n POST de HTTP dise\u00f1ada, relacionada con el uso de una variable UploadDir indefinida."
}
],
"id": "CVE-2008-1924",
"lastModified": "2024-11-21T00:45:40.640",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-04-23T16:05:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29944"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30034"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200805-02.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/28906"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/1328/references"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29944"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30034"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/30816"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/33822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200805-02.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2008/dsa-1557"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2008-3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/28906"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.vupen.com/english/advisories/2008/1328/references"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41964"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-26 03:34
Modified
2024-11-21 01:53
Severity ?
Summary
Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Export feature in phpMyAdmin 4.x before 4.0.0-rc3 allows remote authenticated users to read arbitrary files or possibly have unspecified other impact via a parameter that specifies a crafted export type."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en la funci\u00f3n de exportaci\u00f3n en phpMyAdmin v4.x antes de v4.0.0-RC3 que permite a usuarios remotos autenticados leer archivos arbitrarios o posiblemente tener un impacto no especificado a trav\u00e9s de un par\u00e1metro que especifica un tipo de exportaci\u00f3n elaborado."
}
],
"id": "CVE-2013-3240",
"lastModified": "2024-11-21T01:53:15.080",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-04-26T03:34:23.483",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2013-04/0217.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2013-4.php"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-12-11 03:00
Modified
2024-11-21 03:01
Severity ?
Summary
An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.16:*:*:*:*:*:*:*",
"matchCriteriaId": "B744FB8F-C58C-446C-B4B9-53548EBE12D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.17:*:*:*:*:*:*:*",
"matchCriteriaId": "C50F69E9-0326-4A6F-B2FE-D87AB811281A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en phpMyAdmin. Debido a un error en el an\u00e1lisis de cadenas serializado, fue posible eludir la protecci\u00f3n ofrecida por la funci\u00f3n PMA_safeUnserialize(). Todas las versiones 4.6.x (anteriores a 4.6.5), versiones 4.4.x (anteriores a 4.4.15.9) y versiones 4.0.x (anteriores a 4.0.10.18) est\u00e1n afectadas."
}
],
"id": "CVE-2016-9865",
"lastModified": "2024-11-21T03:01:54.973",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-12-11T03:00:07.477",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/94531"
},
{
"source": "cve@mitre.org",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-70"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/94531"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-70"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-254"
},
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.6.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "74632C65-6711-4425-A43F-CCF1664C8542",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 allow remote attackers to execute arbitrary PHP code by modifying the (1) theme parameter to phpmyadmin.css.php or (2) cfg[Server][extension] parameter to database_interface.lib.php to reference a URL on a remote web server that contains the code."
}
],
"id": "CVE-2005-0567",
"lastModified": "2024-11-20T23:55:24.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/12645"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19465"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=110929725801154\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14382/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1149381\u0026group_id=23067\u0026atid=377408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/12645"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19465"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-03-10 22:19
Modified
2024-11-21 00:28
Severity ?
Summary
Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 2.8.0 | |
| phpmyadmin | phpmyadmin | 2.8.0.1 | |
| phpmyadmin | phpmyadmin | 2.8.0.2 | |
| phpmyadmin | phpmyadmin | 2.8.0.3 | |
| phpmyadmin | phpmyadmin | 2.8.1 | |
| phpmyadmin | phpmyadmin | 2.8.1_dev | |
| phpmyadmin | phpmyadmin | 2.8.2 | |
| phpmyadmin | phpmyadmin | 2.8.3 | |
| phpmyadmin | phpmyadmin | 2.8.4 | |
| phpmyadmin | phpmyadmin | 2.9 | |
| phpmyadmin | phpmyadmin | 2.9.0 | |
| phpmyadmin | phpmyadmin | 2.9.0.1 | |
| phpmyadmin | phpmyadmin | 2.9.0.2 | |
| phpmyadmin | phpmyadmin | 2.9.0.3 | |
| phpmyadmin | phpmyadmin | 2.9.0_beta1 | |
| phpmyadmin | phpmyadmin | 2.9.0_dev | |
| phpmyadmin | phpmyadmin | 2.9.0_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1 | |
| phpmyadmin | phpmyadmin | 2.9.1.1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc1 | |
| phpmyadmin | phpmyadmin | 2.9.1_rc2 | |
| phpmyadmin | phpmyadmin | 2.9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "60F2B3C2-0EDB-48D3-92BC-B1CA0E41F230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D9852676-A91F-4FD6-A734-BF7E048411FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FC64B22B-E415-4510-A0DF-CE4763A423D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "12375469-DD81-42BE-8BC0-FCAB0D2D6253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FCEF6246-C393-41BE-BABC-840585795D53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.1_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "E384B8D4-C72C-4D3D-A25F-26FB5F1D4B89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2ACC829-CF64-4F20-8827-AA95002A6F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05D4C98E-D127-40EB-BE71-A6BB91D4392C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.8.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C26B2DE-669F-4F79-99AE-3210662AAB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B64201-5B5B-4D22-B341-C601DC54BFB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44DA3E88-1572-484D-A4DB-A99EF7D73129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3E65F392-A841-461A-921C-91F40330F3F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A7F2F4E-7DCC-43F8-BB69-BE553C2F8F66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1CDE3326-8B3F-4C3A-BA40-6F91CDFAFA76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_beta1:*:*:*:*:*:*:*",
"matchCriteriaId": "36C4A673-5ACD-4D1A-A780-5CD279230051",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_dev:*:*:*:*:*:*:*",
"matchCriteriaId": "0534C39C-A421-4C97-8A96-A74ABFA78B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.0_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "9BD0DFB0-92F1-4914-A637-A2EBCE0A9BCF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E6354257-6B1A-4729-9EE2-19D3CD2AD62B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4686B445-3843-4173-8565-16BF364EF911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc1:*:*:*:*:*:*:*",
"matchCriteriaId": "1519A451-0EC8-4718-991D-948572C08410",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "9ACAA116-2853-456B-BC9C-B036A0F99FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A8AF5A1A-328E-43A1-8C41-0DAB1F337FA6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase \u003c/SCRIPT\u003e end tag, which bypasses the protection against lowercase \u003c/script\u003e."
},
{
"lang": "es",
"value": "Vulnerabilidad de lista negra incompleta en index.php en phpMyAdmin 2.8.0 hasta 2.9.2 permite a atacantes remotos llevar a cabo ataques de secuencias de comandos de sitios cruzados (XSS) por inyecci\u00f3n de JavaScript de su elecci\u00f3n o HTML en un valor par\u00e1metro (1)db o (2) table seguido de una etiqueta de fin \"may\u00fascula\" \u003c/SCRIPT\u003e, la cual evita la protecci\u00f3n contra la \"min\u00fascula\" \u003c/script\u003e."
}
],
"id": "CVE-2007-1395",
"lastModified": "2024-11-21T00:28:12.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-03-10T22:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35048"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2402"
},
{
"source": "cve@mitre.org",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/462139/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.virtuax.be/advisories/Advisory2-24012007.txt"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32858"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35048"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/26733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2402"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:199"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/462139/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.us.debian.org/security/2007/dsa-1370"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.virtuax.be/advisories/Advisory2-24012007.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32858"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-01-26 15:55
Modified
2024-11-21 01:27
Severity ?
Summary
Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 3.4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:3.4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2C714361-7AE3-4DC2-994C-7C67B41226B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors."
},
{
"lang": "es",
"value": "Abrir redirigir la vulnerabilidad en la funci\u00f3n de redirecci\u00f3n en phpMyAdmin v3.4.x anterior a v3.4.1 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrario y llevar a cabo ataques de phishing a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2011-1941",
"lastModified": "2024-11-21T01:27:21.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-01-26T15:55:01.423",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f"
},
{
"source": "secalert@redhat.com",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=b7a8179eb6bf0f1643970ac57a70b5b513a1cd4f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=ecfc8ba4f7b4ea612c58ab5726054ed0f28e200d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2011-4.php"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.6:*:*:*:*:*:*:*",
"matchCriteriaId": "DB761644-20F5-4E0D-B301-7809EAECA813",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.7:*:*:*:*:*:*:*",
"matchCriteriaId": "896439D0-6C98-44A6-8C9D-0D57D57782D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.8:*:*:*:*:*:*:*",
"matchCriteriaId": "978B828C-1FCB-4386-B685-5BEE5A8A500C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.9:*:*:*:*:*:*:*",
"matchCriteriaId": "51A3261B-23BE-42D7-8A52-AE2E8C274A3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.10:*:*:*:*:*:*:*",
"matchCriteriaId": "F0B7EA51-27EC-4884-8D60-FB9477D2B91A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C9F2CC-778B-4604-B463-7A1D3FB8B9C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4B20C44D-0EF1-48F2-B0AA-C8FF0BD9E252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.13:*:*:*:*:*:*:*",
"matchCriteriaId": "40F85FEC-427E-487D-997E-7EE359475876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.14:*:*:*:*:*:*:*",
"matchCriteriaId": "2C825978-7E00-4C20-A806-0B968AA589AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.15:*:*:*:*:*:*:*",
"matchCriteriaId": "34986C36-1C93-4DA8-A4C2-0CB8B24BAD3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.16, 4.4.x en versiones anteriores a 4.4.15.7 y 4.6.x en versiones anteriores a 4.6.3 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores relacionados con (1)un nombre de tabla manipulado que es manejado incorrectamente durante la comprobaci\u00f3n de privilegios en table_row.phtml, (2) una directiva mysqld log_bin manipulada que es manejada incorrectamente en log_selector.phtml, (3) la implementaci\u00f3n de Transformation, (4) manejo del error AJAX en js/ajax.js, (5) la implementaci\u00f3n de Designer, (6) la implementaci\u00f3n de gr\u00e1ficos en js/tbl_chart.js o (7) la implementaci\u00f3n de b\u00fasqueda de zoom en rows_zoom.phtml."
}
],
"id": "CVE-2016-5733",
"lastModified": "2024-11-21T02:54:55.013",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:23.613",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/91390"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-26/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3627"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/91390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/4d21b5c077db50c2a54b7f569d20f463cc2651f5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/615212a14d7d87712202f37354acf8581987fc5a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/79661610f6f65443e0ec1e382a7240437f28436c"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/8716855b309dbe65d7b9a5d681b80579b225b322"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/895a131d2eb7e447757a35d5731c7d647823ea8b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/960fd1fd52023047a23d069178bfff7463c2cefc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/be3ecbb4cca3fbe20e3b3aa4e049902d18b60865"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d648ade18d6cbb796a93261491c121f078df2d88"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-26/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-07-03 01:59
Modified
2024-11-21 02:54
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.0 | |
| phpmyadmin | phpmyadmin | 4.6.1 | |
| phpmyadmin | phpmyadmin | 4.6.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "A0EA8819-70F8-48DC-8667-6CF25E7D9C53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2796DA-3E74-4765-90D1-783849C7A44C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "4024DA77-BFE4-48C6-A2AF-46003071BDE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la p\u00e1gina table-structure en phpMyAdmin 4.6.x en versiones anteriores a 4.6.3 permite a atacantes remotos inyectar secuencias de comandos web y HTML arbitrarios a trav\u00e9s de vectores relacionados con comentarios."
}
],
"id": "CVE-2016-5704",
"lastModified": "2024-11-21T02:54:51.547",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-07-03T01:59:15.970",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-20/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/72213573182896bd6a6e5af5ba1881dd87c4a20b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2016-20/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-12-20 12:02
Modified
2024-11-21 01:44
Severity ?
Summary
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | 1.0.0 | |
| phpmyadmin | phpmyadmin | 1.0.1 | |
| phpmyadmin | phpmyadmin | 1.0.2 | |
| phpmyadmin | phpmyadmin | 1.0.3 | |
| phpmyadmin | phpmyadmin | 1.0.4 | |
| phpmyadmin | phpmyadmin | 1.0.5 | |
| phpmyadmin | phpmyadmin | 1.0.6 | |
| phpmyadmin | phpmyadmin | 1.0.6 | |
| phpmyadmin | phpmyadmin | 1.0.7 | |
| phpmyadmin | phpmyadmin | 1.0.8 | |
| phpmyadmin | phpmyadmin | 1.1 | |
| phpmyadmin | phpmyadmin | 1.2 | |
| phpmyadmin | phpmyadmin | 1.2.1 | |
| phpmyadmin | phpmyadmin | 1.2.2 | |
| phpmyadmin | phpmyadmin | 1.2.3 | |
| phpmyadmin | phpmyadmin | 1.2.4 | |
| phpmyadmin | phpmyadmin | 1.2.5 | |
| phpmyadmin | phpmyadmin | 1.2.6 | |
| phpmyadmin | phpmyadmin | 1.2.7 | |
| phpmyadmin | phpmyadmin | 1.2.8 | |
| phpmyadmin | phpmyadmin | 1.2.9 | |
| phpmyadmin | phpmyadmin | 1.2.9.1 | |
| phpmyadmin | phpmyadmin | 1.2.9.2 | |
| phpmyadmin | phpmyadmin | 1.2.9.3 | |
| phpmyadmin | phpmyadmin | 1.2.9.4 | |
| phpmyadmin | phpmyadmin | 1.2.9.4 | |
| phpmyadmin | phpmyadmin | 1.2.9.5 | |
| phpmyadmin | phpmyadmin | 1.3 | |
| phpmyadmin | phpmyadmin | 1.3 | |
| wordpress | wordpress | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "36DE9269-E61E-4F24-AC1A-978503933E37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2E1A8297-4418-4DBF-8C53-B5667103DC91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF0D75EB-BEA7-4B0A-8CDD-9207350D0D91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C1CCD716-02E7-4017-98C0-0441D459CAFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4C7B2C59-9084-4456-A2BD-8827562F93EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1911AB52-EEA2-45A6-BF52-304B4FF763B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "86F0CCD7-22AB-474F-BFFC-B4AEAD5C02DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.6:a:*:*:*:*:*:*",
"matchCriteriaId": "2412915B-6D01-40D9-AA9B-E09FC1B86E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2D194DB9-CEA9-4571-A5BD-6900C97AA0B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "D3038292-307C-4FCC-87F7-19FDB183D51E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D2FF9BE0-FEA4-47DA-8558-8959B5612EA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9169B9B4-5E04-45B1-A600-B97B5224D24B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8A5E40DD-F6A3-4D97-8770-4F3776F5CBE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4F6673A9-D214-474B-BC3E-C13ACB3B5204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "15E8363E-3B8A-4248-AFEA-39DE1098712E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "91256645-2A40-4242-B938-234D72C05E20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1BA4F6BA-5678-4D7C-A98F-141079C18523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D06E973A-1C66-43FF-BC61-2FC7DDAFFF57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "169037D5-AEA0-4950-B0BF-EBC9A08AA2DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C9C7CE08-AED8-4D8C-A73F-A69404BAE8DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9A675524-9339-4E5C-9763-2E7EEA6FBCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "42ACF3CF-2BFB-4BA4-9DC1-2B56B847AAF5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F81BFCAE-708F-4C0D-8899-DB3E6F08820B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "0C7C7E0F-9BF4-4719-97C3-4F395EDCAC60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.4:b:*:*:*:*:*:*",
"matchCriteriaId": "AA9D7C76-A7B7-4852-BC34-48C010CA2652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.4:c:*:*:*:*:*:*",
"matchCriteriaId": "CF931388-E9C8-47D7-8A8F-8036B082164E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.2.9.5:*:*:*:*:*:*:*",
"matchCriteriaId": "460F6547-8606-41BA-BCCD-EB38739EB22A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BAF4BE01-9BD6-492C-85E7-BD3CF08F5EA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:1.3:alpha:*:*:*:*:*:*",
"matchCriteriaId": "E9C4C7B1-DD4C-4D58-B36E-786797017625",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wordpress:wordpress:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A77EB0E7-7FA7-4232-97DF-7C7587D163F1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod."
},
{
"lang": "es",
"value": "El complemento phpMyAdmin Portable antes de v1.3.1 para WordPress permite a atacantes remotos evitar la autenticaci\u00f3n y obtener acceso a la consola de phpMyAdmin a trav\u00e9s de una solicitud directa al wp-content/plugins/portable-phpmyadmin/wp-pma-mod."
}
],
"id": "CVE-2012-5469",
"lastModified": "2024-11-21T01:44:42.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-12-20T12:02:18.607",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html"
},
{
"source": "cve@mitre.org",
"url": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-12/0092.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://wordpress.org/extend/plugins/portable-phpmyadmin/changelog/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-11-30 11:59
Modified
2024-11-21 02:20
Severity ?
Summary
Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2F06DC95-76B1-4E24-A55F-1358A25ED0E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B406A721-0075-46C8-A920-3C9602AD667B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C8AE4653-1911-4A58-85DD-51E0578E788E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA76CB4-6167-446A-8D4F-6D5B38046334",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B8D28655-7F37-474D-A4E2-772AF24B94E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA1951E-BD85-42BF-BF7F-79A14D165914",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0D08BEE8-5ACF-438D-9F06-86C6227C9A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "58DD0910-DBBA-4858-B9B1-FA93D08323D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "50DA8EBE-52AA-45A5-A5FB-75AF84E415E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DC8D93A3-8997-4EB9-A411-74B296D1341F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6E5A81B2-E16F-4AE2-9691-92D3E8A25CCB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "0245AF2D-F856-4CAA-A830-36D43026D1E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "00BD9E52-A6BB-48BB-9FEE-D0272AD9B6DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C69E253E-157D-45BA-A977-079A49F74A72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6325E2AE-BB86-4953-AA9E-0433C00B096E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BE5CA497-47A6-4A42-A720-CCB2AD82B22C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3C54B828-8B23-4C62-907E-8EE7E757B721",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02DD18C8-172B-41CD-87DD-58BDEC0D9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "10666E30-D98A-47A9-881A-B281066F0EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3993826B-CA66-4BC2-8E1B-06CF9230B214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.0.10.5:*:*:*:*:*:*:*",
"matchCriteriaId": "14928F51-761E-4FCA-B13C-A11530C7FC46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8F0A53D6-E68D-417E-9B72-55F603EBDFD5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B45FC64-ECDF-474A-9151-30667543760E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "12D9ACD9-BA79-4AC0-800D-A66519799DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5DD938-C9C2-4542-8AD5-4C11FBFA43CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0150F164-B7C2-4E5C-886C-49D651CF307F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB765223-DB56-4327-B150-1D633E4AB41C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58102B9D-C071-43C0-B412-7733E302A944",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "45CDE76C-38B3-41F1-83E7-34F00A4E009A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EA6AE567-72BB-4B5C-A9B3-AF406691491F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A13760E1-EA18-434E-8075-D330AEE05D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A6A3056-B853-4880-BECF-799791B5C660",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "09FA5A47-CEF2-4525-BBE4-D1205172300B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "4D228D62-3E19-4005-A995-39AFF30A978B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C4FF2BA7-F240-4A5B-AC22-62F07D26BB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "8AC849CA-2056-491C-B6B1-3D3A4825BF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "109C5928-FA6D-4835-B538-B235083AF38F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F9DF4655-0731-4C3D-A6D9-E4FFFC63AE08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "69C6393B-C682-4FD2-8ACF-CBBFC9E54286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A68B7DB5-66E6-4E8B-8760-4B3535838641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC60DE84-575A-4031-8B78-AD67C60595AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.1.14.6:*:*:*:*:*:*:*",
"matchCriteriaId": "58D3F904-8C3C-46A5-A7A6-8EFA49648687",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DEC525D5-EA90-4F01-B1D3-64F4BFBFC4DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC297E-A54A-4C92-9BCB-CDDA0C7E56C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4FA4B695-DD00-45FE-8A74-A34E9920EE23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BC38B8F8-DB1C-4A7D-A15B-390754687F18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA5B74C-F0E8-46D0-AF53-A25145DA3E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A6DD88B5-9F4D-4B1C-8A36-CA9727514B42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E8645867-C499-41C6-8AA4-B5CB0DB4BB6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "58EFA2AE-0CF3-47AE-9996-F3685851EA83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "708FC2C9-6038-4FDF-9B41-EFBBEA23F114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "79B0DE12-E756-44B3-8C2F-8C9246F36BC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "50E07E05-60B4-4427-81B0-F44C3089E1F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "887DAFF7-7344-4A1C-9DC0-C41BA3E7C092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "2E9EFDB0-7D5A-4E6D-AAC3-A26121E2C152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E0716B60-E8C7-40EA-8A96-9EC0D868D11A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in libraries/gis/GIS_Factory.class.php in the GIS editor in phpMyAdmin 4.0.x before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allows remote authenticated users to include and execute arbitrary local files via a crafted geometry-type parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en libraries/gis/GIS_Factory.class.php en el editor GIS en phpMyAdmin 4.0.x anterior a 4.0.10.6, 4.1.x anterior a 4.1.14.7, y 4.2.x anterior a 4.2.12 permite a usuarios remotos autenticados incluir y ejecutar ficheros locales arbitrarios a trav\u00e9s de un par\u00e1metro del tipo \u0027geometr\u00eda\u0027 manipulado."
}
],
"id": "CVE-2014-8959",
"lastModified": "2024-11-21T02:20:00.600",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-11-30T11:59:01.743",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/71247"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201505-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2014-12/msg00017.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:228"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phpmyadmin.net/home_page/security/PMASA-2014-14.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/71247"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/80cd40b6687a6717860d345d6eb55bef2908e961"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201505-03"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-05-01 17:29
Modified
2024-11-21 03:19
Severity ?
Summary
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.securityfocus.com/bid/97211 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | Third Party Advisory | |
| cve@mitre.org | https://www.phpmyadmin.net/security/PMASA-2017-8/ | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/97211 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.phpmyadmin.net/security/PMASA-2017-8/ | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | * | |
| phpmyadmin | phpmyadmin | 4.7.0 | |
| phpmyadmin | phpmyadmin | 4.7.0 | |
| debian | debian_linux | 8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "55082B30-4479-44A1-BF12-28833A589B50",
"versionEndExcluding": "4.0.10.20",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "928D191C-A3A7-4DEE-87AF-CF2A03295798",
"versionEndIncluding": "4.4.15.10",
"versionStartIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F21A70D3-CFF3-4A41-82BC-9EA2D7A190B6",
"versionEndIncluding": "4.6.6",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.7.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "02F545DB-D076-4FFB-8169-3E59D367D381",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.7.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "75C9463D-85A0-4B8C-A2EA-0C18381E3C2E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given \u0027\u0027 as the first argument."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en libraries/common.inc.php en phpMyAdmin en versiones 4.0 anteriores a la 4.0.10.20, 4.4.x, 4.6.x y 4.7.0 \"prereleases\". Las restricciones causadas por $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] = false se omiten en determinadas versiones PHP (por ejemplo, la versi\u00f3n 5). Esto puede permitir que inicien sesi\u00f3n los usuarios que no tengan una contrase\u00f1a establecida incluso si el administrador tiene establecido $cfg[\u0027Servers\u0027][$i][\u0027AllowNoPassword\u0027] en \"false\" (que es tambi\u00e9n el valor por defecto). Esto ocurre porque determinadas implementaciones de la funci\u00f3n de PHP substr devuelven el valor \"falso\" cuando se proporciona el car\u00e1cter \" como primer argumento."
}
],
"id": "CVE-2017-18264",
"lastModified": "2024-11-21T03:19:43.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-05-01T17:29:00.237",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97211"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-8/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97211"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://www.phpmyadmin.net/security/PMASA-2017-8/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
var-200511-0093
Vulnerability from variot
CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts. phpMyAdmin is prone to an HTTP-response-splitting vulnerability because the application fails to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. This issue is reported to affect phpMyAdmin version 2.7.0-beta1; other versions may also be vulnerable.
The vulnerability is caused due to an error in the register_globals emulation layer in "grab_globals.php" where the "import_blacklist" variable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. http://www.phpmyadmin.net/home_page/downloads.php
PROVIDED AND/OR DISCOVERED BY: Reported by vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Debian Security Advisory DSA 1207-2 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 19th, 2006 http://www.debian.org/security/faq
Package : phpmyadmin Vulnerability : several Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-1678 CVE-2006-2418 CVE-2005-3621 CVE-2005-3665 CVE-2006-5116 Debian Bug : 339437 340438 362567 368082 391090
The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, the original advisory text below:
Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web.
CVE-2005-3665
Multiple cross-site scripting (XSS) vulnerabilities allow remote
attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST
variable and (2) various scripts in the libraries directory that
handle header generation.
CVE-2006-1678
Multiple cross-site scripting (XSS) vulnerabilities allow remote
attackers to inject arbitrary web script or HTML via scripts in the
themes directory.
CVE-2006-5116
A remote attacker could overwrite internal variables through the
_FILES global variable.
For the stable distribution (sarge) these problems have been fixed in version 2.6.2-3sarge3.
For the upcoming stable release (etch) and unstable distribution (sid) these problems have been fixed in version 2.9.0.3-1.
We recommend that you upgrade your phpmyadmin package.
Upgrade Instructions
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update will update the internal database apt-get upgrade will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.dsc
Size/MD5 checksum: 604 32ee16f4370604bc150d93c5676fface
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.diff.gz
Size/MD5 checksum: 38520 f27c4b99bbdb3dc13fb71aef99749247
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz
Size/MD5 checksum: 2654418 05e33121984824c43d94450af3edf267
Architecture independent components:
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3_all.deb
Size/MD5 checksum: 2769182 00f14fb52a14546e92ece84c16cd249f
These files will probably be moved into the stable distribution on its next update.
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show
iD8DBQFFYFPdXm3vHE4uyloRAgj5AJ4k0NXBlTZgTK+vJTlgPNTEBfeBGgCg61oX s2aDzIfiBIc0hbLjIGOwEcQ= =EQpq -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ .
To improve our services to our customers, we have made a number of additions to the Secunia Advisories and have started translating the advisories to German.
The improvements will help our customers to get a better understanding of how we reached our conclusions, how it was rated, our thoughts on exploitation, attack vectors, and scenarios.
For more information: SA17578 SA17895 SA19556 SA20113 SA22126
SOLUTION: Apply updated packages.
Some input passed to "libraries/header_http.inc.php" isn't properly sanitised before being returned to the user. This can be exploited to include arbitrary HTTP headers in a response sent to the user.
Successful exploitation requires that "register_globals" is enabled.
It is also possible to disclose the full path to certain scripts by accessing them directly. http://www.phpmyadmin.net/home_page/downloads.php
PROVIDED AND/OR DISCOVERED BY: Toni Koivunen
ORIGINAL ADVISORY: Toni Koivunen: http://www.fitsec.com/advisories/FS-05-02.txt
phpMyAdmin: http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200511-0093",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.6.1_pl3"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.3"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.2_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.6_rc2"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.4"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.2.7_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.6.0_pl3"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.2.0"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.5_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.6,
"vendor": "phpmyadmin",
"version": "2.5.7_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.0,
"vendor": "phpmyadmin",
"version": "2.6.2_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.0,
"vendor": "phpmyadmin",
"version": "2.6.3_pl1"
},
{
"model": "phpmyadmin",
"scope": "eq",
"trust": 1.0,
"vendor": "phpmyadmin",
"version": "2.6.4_pl3"
},
{
"model": "web application server",
"scope": "eq",
"trust": 0.3,
"vendor": "sap",
"version": "7.0"
},
{
"model": "web application server",
"scope": "eq",
"trust": 0.3,
"vendor": "sap",
"version": "6.40"
},
{
"model": "web application server",
"scope": "eq",
"trust": 0.3,
"vendor": "sap",
"version": "6.20"
},
{
"model": "web application server",
"scope": "eq",
"trust": 0.3,
"vendor": "sap",
"version": "6.10"
},
{
"model": "linux professional oss",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "10.0"
},
{
"model": "linux professional x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.3"
},
{
"model": "linux professional",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.3"
},
{
"model": "linux professional x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.2"
},
{
"model": "linux professional",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.2"
},
{
"model": "linux professional x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.1"
},
{
"model": "linux professional",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.1"
},
{
"model": "linux professional x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.0"
},
{
"model": "linux professional",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.0"
},
{
"model": "linux personal oss",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "10.0"
},
{
"model": "linux personal x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.3"
},
{
"model": "linux personal",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.3"
},
{
"model": "linux personal x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.2"
},
{
"model": "linux personal",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.2"
},
{
"model": "linux personal x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.1"
},
{
"model": "linux personal",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.1"
},
{
"model": "linux personal x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.0"
},
{
"model": "linux personal",
"scope": "eq",
"trust": 0.3,
"vendor": "s u s e",
"version": "9.0"
},
{
"model": ".0-beta1",
"scope": "eq",
"trust": 0.3,
"vendor": "phpmyadmin",
"version": "2.7"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux ppc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux mipsel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux m68k",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux hppa",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "3.1"
}
],
"sources": [
{
"db": "BID",
"id": "15422"
},
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.5_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.4_pl3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.2.7_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.2_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.7_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.0_pl3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.1_pl3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.2_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.5.6_rc2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:phpmyadmin:phpmyadmin:2.6.3_pl1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3621"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Toni Koivunen is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "15422"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
],
"trust": 0.9
},
"cve": "CVE-2005-3621",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2005-3621",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200511-204",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts. phpMyAdmin is prone to an HTTP-response-splitting vulnerability because the application fails to properly sanitize user-supplied input. \nA remote attacker may exploit this vulnerability to influence or misrepresent web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. \nThis issue is reported to affect phpMyAdmin version 2.7.0-beta1; other versions may also be vulnerable. \n\nThe vulnerability is caused due to an error in the register_globals\nemulation layer in \"grab_globals.php\" where the \"import_blacklist\"\nvariable is not properly protected from being overwritten. This can be exploited to execute arbitrary HTML\nand script code in a user\u0027s browser session in context of an affected\nsite. \nhttp://www.phpmyadmin.net/home_page/downloads.php\n\nPROVIDED AND/OR DISCOVERED BY:\nReported by vendor. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n- --------------------------------------------------------------------------\nDebian Security Advisory DSA 1207-2 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nNovember 19th, 2006 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : phpmyadmin\nVulnerability : several\nProblem-Type : remote\nDebian-specific: no\nCVE ID : CVE-2006-1678 CVE-2006-2418 CVE-2005-3621 CVE-2005-3665 CVE-2006-5116\nDebian Bug : 339437 340438 362567 368082 391090\n\nThe phpmyadmin update in DSA 1207 introduced a regression. This update\ncorrects this flaw. For completeness, the original advisory text below:\n \nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a\nprogram to administrate MySQL over the web. \n\nCVE-2005-3665\n\n Multiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST\n variable and (2) various scripts in the libraries directory that\n handle header generation. \n\nCVE-2006-1678\n\n Multiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML via scripts in the\n themes directory. \n\nCVE-2006-5116\n\n A remote attacker could overwrite internal variables through the\n _FILES global variable. \n\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.6.2-3sarge3. \n\nFor the upcoming stable release (etch) and unstable distribution (sid)\nthese problems have been fixed in version 2.9.0.3-1. \n\nWe recommend that you upgrade your phpmyadmin package. \n\nUpgrade Instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file. \n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration. \n\n\nDebian GNU/Linux 3.1 alias sarge\n- --------------------------------\n\n Source archives:\n\n http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.dsc\n Size/MD5 checksum: 604 32ee16f4370604bc150d93c5676fface\n http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.diff.gz\n Size/MD5 checksum: 38520 f27c4b99bbdb3dc13fb71aef99749247\n http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz\n Size/MD5 checksum: 2654418 05e33121984824c43d94450af3edf267\n\n Architecture independent components:\n\n http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3_all.deb\n Size/MD5 checksum: 2769182 00f14fb52a14546e92ece84c16cd249f\n\n\n These files will probably be moved into the stable distribution on\n its next update. \n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show \u003cpkg\u003e\u0027 and http://packages.debian.org/\u003cpkg\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.5 (GNU/Linux)\n\niD8DBQFFYFPdXm3vHE4uyloRAgj5AJ4k0NXBlTZgTK+vJTlgPNTEBfeBGgCg61oX\ns2aDzIfiBIc0hbLjIGOwEcQ=\n=EQpq\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. \n\n----------------------------------------------------------------------\n\nTo improve our services to our customers, we have made a number of\nadditions to the Secunia Advisories and have started translating the\nadvisories to German. \n\nThe improvements will help our customers to get a better\nunderstanding of how we reached our conclusions, how it was rated,\nour thoughts on exploitation, attack vectors, and scenarios. \n\nFor more information:\nSA17578\nSA17895\nSA19556\nSA20113\nSA22126\n\nSOLUTION:\nApply updated packages. \r\n\r\nSome input passed to \"libraries/header_http.inc.php\" isn\u0027t properly\nsanitised before being returned to the user. This can be exploited to\ninclude arbitrary HTTP headers in a response sent to the user. \r\n\r\nSuccessful exploitation requires that \"register_globals\" is enabled. \r\n\r\nIt is also possible to disclose the full path to certain scripts by\naccessing them directly. \r\nhttp://www.phpmyadmin.net/home_page/downloads.php\n\nPROVIDED AND/OR DISCOVERED BY:\nToni Koivunen\n\nORIGINAL ADVISORY:\nToni Koivunen:\r\nhttp://www.fitsec.com/advisories/FS-05-02.txt\r\n\r\nphpMyAdmin:\r\nhttp://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-6\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "BID",
"id": "15422"
},
{
"db": "PACKETSTORM",
"id": "43410"
},
{
"db": "PACKETSTORM",
"id": "42148"
},
{
"db": "PACKETSTORM",
"id": "42110"
},
{
"db": "PACKETSTORM",
"id": "52337"
},
{
"db": "PACKETSTORM",
"id": "51974"
},
{
"db": "PACKETSTORM",
"id": "51856"
},
{
"db": "PACKETSTORM",
"id": "41587"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2005-3621",
"trust": 2.1
},
{
"db": "SECUNIA",
"id": "22781",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "17578",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1015213",
"trust": 1.6
},
{
"db": "SUSE",
"id": "SUSE-SR:2005:028",
"trust": 0.6
},
{
"db": "DEBIAN",
"id": "DSA-1207",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204",
"trust": 0.6
},
{
"db": "BID",
"id": "15422",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "18618",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "43410",
"trust": 0.1
},
{
"db": "SECUNIA",
"id": "17925",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "42148",
"trust": 0.1
},
{
"db": "SECUNIA",
"id": "17895",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "42110",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "52337",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "51974",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "51856",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "41587",
"trust": 0.1
}
],
"sources": [
{
"db": "BID",
"id": "15422"
},
{
"db": "PACKETSTORM",
"id": "43410"
},
{
"db": "PACKETSTORM",
"id": "42148"
},
{
"db": "PACKETSTORM",
"id": "42110"
},
{
"db": "PACKETSTORM",
"id": "52337"
},
{
"db": "PACKETSTORM",
"id": "51974"
},
{
"db": "PACKETSTORM",
"id": "51856"
},
{
"db": "PACKETSTORM",
"id": "41587"
},
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"id": "VAR-200511-0093",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.50441176
},
"last_update_date": "2023-12-18T11:16:35.467000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-3621"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=pmasa-2005-6"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/17578"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/22781"
},
{
"trust": 1.6,
"url": "http://securitytracker.com/id?1015213"
},
{
"trust": 1.6,
"url": "http://www.debian.org/security/2006/dsa-1207"
},
{
"trust": 1.6,
"url": "http://www.novell.com/linux/security/advisories/2005_28_sr.html"
},
{
"trust": 0.5,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.5,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.5,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.4,
"url": "http://www.fitsec.com/advisories/fs-05-02.txt"
},
{
"trust": 0.3,
"url": "http://www.owasp.org/index.php/main_page"
},
{
"trust": 0.3,
"url": "http://www.sap.com"
},
{
"trust": 0.3,
"url": "/archive/1/416696"
},
{
"trust": 0.3,
"url": "/archive/1/416148"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/17578/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/17895/"
},
{
"trust": 0.3,
"url": "http://secunia.com/product/1720/"
},
{
"trust": 0.3,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/17925/"
},
{
"trust": 0.2,
"url": "http://www.phpmyadmin.net/home_page/downloads.php"
},
{
"trust": 0.2,
"url": "http://secunia.com/product/1719/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-1678"
},
{
"trust": 0.2,
"url": "http://packages.debian.org/\u003cpkg\u003e"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-5116"
},
{
"trust": 0.2,
"url": "http://security.debian.org/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2006-2418"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.2,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2005-3665"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2005-3621"
},
{
"trust": 0.2,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge2_all.deb"
},
{
"trust": 0.2,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge2.diff.gz"
},
{
"trust": 0.2,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge2.dsc"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4258/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4933/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/2467/"
},
{
"trust": 0.1,
"url": "http://lists.suse.com/archive/suse-security-announce/2006-jan/0006.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/6221/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/18618/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/3473/"
},
{
"trust": 0.1,
"url": "http://www.hardened-php.net/advisory_252005.110.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/17289/"
},
{
"trust": 0.1,
"url": "http://sourceforge.net/project/showfiles.php?group_id=23067"
},
{
"trust": 0.1,
"url": "http://www.phpmyadmin.net/home_page/security.php?issue=pmasa-2005-8"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3_all.deb"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.diff.gz"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.dsc"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/22781/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/19556/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/products/48/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/530/"
},
{
"trust": 0.1,
"url": "http://www.us.debian.org/security/2006/dsa-1207"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20113/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5307/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/15/?r=l"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/22126/"
}
],
"sources": [
{
"db": "BID",
"id": "15422"
},
{
"db": "PACKETSTORM",
"id": "43410"
},
{
"db": "PACKETSTORM",
"id": "42148"
},
{
"db": "PACKETSTORM",
"id": "42110"
},
{
"db": "PACKETSTORM",
"id": "52337"
},
{
"db": "PACKETSTORM",
"id": "51974"
},
{
"db": "PACKETSTORM",
"id": "51856"
},
{
"db": "PACKETSTORM",
"id": "41587"
},
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "15422"
},
{
"db": "PACKETSTORM",
"id": "43410"
},
{
"db": "PACKETSTORM",
"id": "42148"
},
{
"db": "PACKETSTORM",
"id": "42110"
},
{
"db": "PACKETSTORM",
"id": "52337"
},
{
"db": "PACKETSTORM",
"id": "51974"
},
{
"db": "PACKETSTORM",
"id": "51856"
},
{
"db": "PACKETSTORM",
"id": "41587"
},
{
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-11-09T00:00:00",
"db": "BID",
"id": "15422"
},
{
"date": "2006-01-27T06:43:36",
"db": "PACKETSTORM",
"id": "43410"
},
{
"date": "2005-12-07T17:36:35",
"db": "PACKETSTORM",
"id": "42148"
},
{
"date": "2005-12-07T01:44:11",
"db": "PACKETSTORM",
"id": "42110"
},
{
"date": "2006-11-20T16:15:03",
"db": "PACKETSTORM",
"id": "52337"
},
{
"date": "2006-11-13T15:36:34",
"db": "PACKETSTORM",
"id": "51974"
},
{
"date": "2006-11-10T16:02:24",
"db": "PACKETSTORM",
"id": "51856"
},
{
"date": "2005-11-19T21:56:12",
"db": "PACKETSTORM",
"id": "41587"
},
{
"date": "2005-11-16T11:02:00",
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"date": "2005-11-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-01-12T22:30:00",
"db": "BID",
"id": "15422"
},
{
"date": "2008-09-05T20:54:49.227000",
"db": "NVD",
"id": "CVE-2005-3621"
},
{
"date": "2005-11-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "51974"
},
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "phpMyAdmin CRLF Injection vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200511-204"
}
],
"trust": 0.6
}
}