CVSS: 5.3EPSS: 0%CPEs: 50EXPL: 0CVE-2016-2039 – Debian Security Advisory 3627-1
https://notcve.org/view.php?id=CVE-2016-2039
20 Feb 2016 — libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value. libraries/session.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 no genera adecuadamente valores de token CSRF, lo que permite a atacantes remotos eludir las restric... • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 50EXPL: 0CVE-2016-2041 – Debian Security Advisory 3627-1
https://notcve.org/view.php?id=CVE-2016-2041
20 Feb 2016 — libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences. libraries/common.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.13, 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 no utiliza un algoritmo de tiempo constante para comparar tok... • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html • CWE-254: 7PK - Security Features •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2016-2045
https://notcve.org/view.php?id=CVE-2016-2045
20 Feb 2016 — Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response. Vulnerabilidad de XSS en el editor SQL en phpMyAdmin 4.5.x en versiones anteriores a 4.5.4 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una consulta SQL que desencadena datos JSON en una respuesta. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 32EXPL: 0CVE-2016-2043
https://notcve.org/view.php?id=CVE-2016-2043
20 Feb 2016 — Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page. Vulnerabilidad de XSS en la función goToFinish1NF en js/normalization.js en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.3 y 4.5.x en versiones anteriores a 4.5.4 permite a usuarios remotos autenticados inyectar secuencias de comandos we... • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2016-2044
https://notcve.org/view.php?id=CVE-2016-2044
20 Feb 2016 — libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message. libraries/sql-parser/autoload.php en analizador SQL en phpMyAdmin 4.5.x en versiones anteriores a 4.5.4 permite a atacantes remotos obtener información sensible a través de una petición manipulada, lo cual revela la ruta completa en un mensaje de error. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 50EXPL: 0CVE-2015-8669
https://notcve.org/view.php?id=CVE-2015-8669
26 Dec 2015 — libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message. libraries/config/messages.inc.php en phpMyAdmin 4.0.x en versiones anteriores a 4.0.10.12, 4.4.x en versiones anteriores a 4.4.15.2 y 4.5.x en versiones anteriores a 4.5.3.1 permite a atacantes remotos obtener información sensible a través de una petición manipula... • http://lists.opensuse.org/opensuse-updates/2016-01/msg00014.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 0CVE-2015-7873 – Debian Security Advisory 3382-1
https://notcve.org/view.php?id=CVE-2015-7873
28 Oct 2015 — The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter. La funcionalidad de redireccionado en url.php en phpMyAdmin 4.4.x en versiones anteriores a 4.4.15.1 y 4.5.x en versiones anteriores a 4.5.1 permite a atacantes remotos suplantar contenido a través de un parámetro url. Several issues have been fixed in phpMyAdmin, the web administration tool for MySQL. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171311.html • CWE-254: 7PK - Security Features •
CVSS: 9.1EPSS: 0%CPEs: 31EXPL: 0CVE-2015-6830 – Debian Security Advisory 3382-1
https://notcve.org/view.php?id=CVE-2015-6830
14 Sep 2015 — libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha. Vulnerabilidad en libraries/plugins/auth/AuthenticationCookie.class.php en phpMyAdmin 4.3.x en versiones anteriores a 4.3.13.2 y 4.4.x en versiones anteriores a 4.4.14.1, permite a atacantes remotos eludir un mecanismo de pro... • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 56EXPL: 0CVE-2015-3902 – Debian Security Advisory 3382-1
https://notcve.org/view.php?id=CVE-2015-3902
26 May 2015 — Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file. Múltiples vulnerabilidades de CSRF en el proceso de montaje en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 permiten a atacantes ... • http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 56EXPL: 2CVE-2015-3903 – phpMyAdmin 4.4.6 Man-In-The-Middle
https://notcve.org/view.php?id=CVE-2015-3903
14 May 2015 — libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. libraries/Config.class.php en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 deshabilita la verificación de los ce... • http://cxsecurity.com/issue/WLB-2015050095 • CWE-310: Cryptographic Issues •