CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 3CVE-2013-5029 – Gentoo Linux Security Advisory 201311-02
https://notcve.org/view.php?id=CVE-2013-5029
19 Aug 2013 — phpMyAdmin 3.5.x and 4.0.x before 4.0.5 allows remote attackers to bypass the clickjacking protection mechanism via certain vectors related to Header.class.php. phpMyAdmin 3.5.x y 4.0.x anterior a 4.0.5, permite a atacantes remotos evitar la protección frente al clickjacking a través de determinados vectores relacionados con Header.class.php. Multiple vulnerabilities have been found in phpMyAdmin, allowing remote authenticated attackers to execute arbitrary code, inject SQL code or conduct other attacks. Ve... • http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00013.html • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2013-4995 – Debian Security Advisory 2975-1
https://notcve.org/view.php?id=CVE-2013-4995
30 Jul 2013 — Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information. Vulnerabilidad XSS en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML arbitrarias a través de una petición SQL que no está manejada adecuadamen... • http://secunia.com/advisories/59832 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 22EXPL: 0CVE-2013-4996 – Debian Security Advisory 2975-1
https://notcve.org/view.php?id=CVE-2013-4996
30 Jul 2013 — Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted database name, (2) a crafted user name, (3) a crafted logo URL in the navigation panel, (4) a crafted entry in a certain proxy list, or (5) crafted content in a version.json file. Múltiples vulnerabilidades de XSS en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a atacantes r... • http://secunia.com/advisories/59832 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 22EXPL: 0CVE-2013-4998 – Mandriva Linux Security Advisory 2013-203
https://notcve.org/view.php?id=CVE-2013-4998
30 Jul 2013 — phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files. phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a atacantes remotos obtener información sensible a través de una petición inválida, que revela la ruta de instalación en un mensaje de error. Relacionado con pmd_common.php y otros archivos. Multiple vul... • http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2013-4999 – Gentoo Linux Security Advisory 201311-02
https://notcve.org/view.php?id=CVE-2013-4999
30 Jul 2013 — phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php. phpMyAdmin 4.0.x anterior a 4.0.4.2, permite a atacantes remotos obtener información sensible a través de una petición inválida, que revela la ruta de instalación en un mensaje de error. Relacionado con Error.class.php y Error_Handler.class.php. Multiple vulnerabilities have been found ... • http://www.phpmyadmin.net/home_page/security/PMASA-2013-12.php • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2013-5001 – Gentoo Linux Security Advisory 201311-02
https://notcve.org/view.php?id=CVE-2013-5001
30 Jul 2013 — Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link. Vulnerabilidad XSS enlibraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php en phpMyAdmin 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar s... • http://www.phpmyadmin.net/home_page/security/PMASA-2013-13.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2013-5002 – Debian Security Advisory 2975-1
https://notcve.org/view.php?id=CVE-2013-5002
30 Jul 2013 — Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php. Vulnerabilidad XSS en libraries/schema/Export_Relation_Schema.class.php en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente inyectar secuencias web o HTML arbitrarias a trav... • http://secunia.com/advisories/59832 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 0CVE-2013-5003 – Debian Security Advisory 2975-1
https://notcve.org/view.php?id=CVE-2013-5003
30 Jul 2013 — Multiple SQL injection vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote authenticated users to execute arbitrary SQL commands via (1) the scale parameter to pmd_pdf.php or (2) the pdf_page_number parameter to schema_export.php. Múltiples vulnerabilidades de inyección SQL en phpMyAdmin 3.5.x anterior a 3.5.8.2 y 4.0.x anterior a 4.0.4.2, permite a usuarios autenticados remotamente ejecutar comandos SQL arbitrarios a través de (1)el parámetro "scale" a pmd_pdf.php o (2)... • http://secunia.com/advisories/59832 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2013-3742
https://notcve.org/view.php?id=CVE-2013-3742
04 Jul 2013 — Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message. Vulnerabilidad de ejecuciónd de secuencias de comandos en sitios cruzados (XSS) en view_create.php (también conocido como la página Create View) en phpMyAdmin v4.x antes de v4.0.3 permite a usuarios remotos autenticados inyectar... • http://www.phpmyadmin.net/home_page/security/PMASA-2013-6.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 1CVE-2013-4729
https://notcve.org/view.php?id=CVE-2013-4729
04 Jul 2013 — import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request. import.php en phpMyAdmin v4.x anterior a v4.0.4.1 no restringe correctamente la capacidad de la entrada de datos a un formato de fichero específico, lo que permite a usuarios remotamente autenticados modificar el array global GLOBALS, y conse... • http://www.phpmyadmin.net/home_page/security/PMASA-2013-7.php • CWE-264: Permissions, Privileges, and Access Controls •