CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2005-4450
https://notcve.org/view.php?id=CVE-2005-4450
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.7.0 allows remote attackers to perform unauthorized actions as a logged-in user via a link or IMG tag to server_privileges.php, as demonstrated using the dbname and checkprivs parameters. NOTE: the provenance of this issue is unknown, although third parties imply that it is related to the disclosure of CVE-2005-4349, which was labeled as SQL injection but disputed. • http://secunia.com/advisories/18113 •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2005-4349
https://notcve.org/view.php?id=CVE-2005-4349
SQL injection vulnerability in server_privileges.php in phpMyAdmin 2.7.0 allows remote authenticated users to execute arbitrary SQL commands via the (1) dbname and (2) checkprivs parameters. NOTE: the vendor and a third party have disputed this issue, saying that the main task of the program is to support query execution by authenticated users, and no external attack scenario exists without an auto-login configuration. Thus it is likely that this issue will be REJECTED. However, a closely related CSRF issue has been assigned CVE-2005-4450 ** DISPUTADA ** Vulnerabilidad de inyección de SQL en server_privileges.php en phpMyAdmin 2.7.0 permite a atacantes remotos ejecutar órdenes SQL de su elección mediante los parámetros (1)dbname y (2) checkprivs. NOTA: el fabricante y una tercera parte disputan esta cuestión, diciendo que la tarea principal del programa es soportar la ejecución de consultas por usuarios autenticados, y no existe ningún escenario de ataque externo sin una configuración con inicio automático de sesión. Por lo tanto, es probable que esta cuestión sea rechazada. • http://marc.info/?l=bugtraq&m=113486637512821&w=2 http://secunia.com/advisories/18113 http://securityreason.com/securityalert/270 http://www.securityfocus.com/archive/1/419829/100/0/threaded http://www.securityfocus.com/archive/1/419832/100/0/threaded http://www.vupen.com/english/advisories/2005/2995 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 1%CPEs: 49EXPL: 0CVE-2005-3665
https://notcve.org/view.php?id=CVE-2005-3665
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST variable and (2) various scripts in the libraries directory that handle header generation. • http://secunia.com/advisories/17895 http://secunia.com/advisories/17957 http://secunia.com/advisories/18618 http://secunia.com/advisories/22781 http://www.debian.org/security/2006/dsa-1207 http://www.gentoo.org/security/en/glsa/glsa-200512-03.xml http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2005-8 http://www.securityfocus.com/archive/1/423142/100/0/threaded http://www.securityfocus.com/bid/15735 http://www.vupen.com/english/advisories/2005/2772 •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 0CVE-2005-3622
https://notcve.org/view.php?id=CVE-2005-3622
phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in the libraries directory. phpMyAdmin 2.7.0-beta1 y anteriores permiten a atacantes remotos obtener la ruta completa del servidor mediante peticiones directas a varios scripts en el directorio de bibliotecas. • http://marc.info/?l=bugtraq&m=113208319104035&w=2 http://securityreason.com/securityalert/185 http://securitytracker.com/id?1015213 http://www.fitsec.com/advisories/FS-05-02.txt http://www.osvdb.org/20911 http://www.osvdb.org/20912 http://www.osvdb.org/20913 http://www.osvdb.org/20914 •