CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 1CVE-2006-6943 – phpMyAdmin 2.x - Multiple Script Array Handling Full Path Disclosures
https://notcve.org/view.php?id=CVE-2006-6943
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php. PhpMyAdmin en versiones anteriores a 2.9.1.1 permite a atacantes remotos obtener la ruta completa del servidor a través de peticiones directas a (a) scripts/check_lang.php y (b) themes/darkblue_orange/layout.inc.php; y a través de los argumentos de array (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[] y (6) tbl_group[] en (c) index.php y el argumento (7) back[] en(d) sql.php; y un parámetro no válido (8) sort_by en (e) server_databases.php y (9) el parámetro db en (f) db_printview.php. • https://www.exploit-db.com/exploits/29062 http://marc.info/?l=bugtraq&m=116370414309444&w=2 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8 http://www.securityfocus.com/bid/21137 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2006-6944
https://notcve.org/view.php?id=CVE-2006-6944
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers. phpMyAdmin versiones anteriores a 2.9.1.1 permite a atacantes remotos evitar reglas de acceso Permitir/Denegar que usan direcciones IP mediante cabeceras falsas. • http://secunia.com/advisories/26733 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9 http://www.us.debian.org/security/2007/dsa-1370 http://www.vupen.com/english/advisories/2006/4572 •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1CVE-2007-0341
https://notcve.org/view.php?id=CVE-2007-0341
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin 2.8.1 y anteriores, al usar Microsoft Internet Explorer 6, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante un URI del tipo javascript: en un estilo CSS en el parámetro convcharset al URI de nivel superior, una vulnerabilidad diferente que CVE-2005-0992. • http://www.securityfocus.com/archive/1/456698/100/0/threaded http://www.securityfocus.com/archive/1/456726/100/0/threaded http://www.virtuax.be/advisories/Advisory1-12012007.txt •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0203
https://notcve.org/view.php?id=CVE-2007-0203
Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en phpMyAdmin versiones anteriores a 2.9.2-rc1 tienen un impacto desconocido y vectores de ataque. • http://osvdb.org/32666 http://secunia.com/advisories/23702 http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 http://www.securityfocus.com/bid/21987 http://www.vupen.com/english/advisories/2007/0125 •
CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 0CVE-2007-0204
https://notcve.org/view.php?id=CVE-2007-0204
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin versiones anteriores a 2.9.2-rc1 permite a atacantes remotos inyectar scripts web o HTML de su elección mediante vectores no especificados. NOTA: algunos de estos detalles se han obtenido de información de terceros. • http://osvdb.org/32667 http://secunia.com/advisories/23702 http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 http://www.securityfocus.com/bid/21987 http://www.vupen.com/english/advisories/2007/0125 https://exchange.xforce.ibmcloud.com/vulnerabilities/31387 •