CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2011-2718
https://notcve.org/view.php?id=CVE-2011-2718
01 Aug 2011 — Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php. Múltiples vulnerabilidades de salto de directorio en la implementación del esquema relacional en phpMyAdmin v3.4.x anterior a v3.4.3.2 permite a usuarios autenticados de form... • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 11%CPEs: 48EXPL: 4CVE-2011-2505 – phpMyAdmin3 (pma3) - Remote Code Execution
https://notcve.org/view.php?id=CVE-2011-2505
14 Jul 2011 — libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability." libraries/auth/swekey/swekey.auth.lib.php en la función de autenticación Swekey en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 as... • https://www.exploit-db.com/exploits/17510 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 13%CPEs: 48EXPL: 1CVE-2011-2508
https://notcve.org/view.php?id=CVE-2011-2508
14 Jul 2011 — Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter. Vulnerabilidad de salto de directorio en libraries/display_tbl.lib.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 cuando una determinada transf... • http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 26%CPEs: 48EXPL: 4CVE-2011-2506 – phpMyAdmin 3.x - Swekey Remote Code Injection
https://notcve.org/view.php?id=CVE-2011-2506
14 Jul 2011 — setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array. setup/lib/ConfigGenerator.class.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 no restringe correctamente la presencia de los delimitadores de cierre de comentario, permitiendo a ata... • https://www.exploit-db.com/exploits/17514 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 9%CPEs: 48EXPL: 2CVE-2011-2507
https://notcve.org/view.php?id=CVE-2011-2507
14 Jul 2011 — libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array. libraries/server_synchronize.lib.php en la implementación Synchronize en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3... • http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 67EXPL: 0CVE-2011-0986
https://notcve.org/view.php?id=CVE-2011-0986
14 Feb 2011 — phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file. PhpMyAdmin v2.11.x antes de v2.11.11.2, y v3.3.x antes de v3.3.9.1, no controla correctamente la ausencia de los ficheros (1) README, (2) Changelog , y (3) Los archivos de licencia, que permite a atacantes remotos obtener la ruta de instalación a tr... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 69EXPL: 0CVE-2011-0987
https://notcve.org/view.php?id=CVE-2011-0987
14 Feb 2011 — The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark. La función PMA_Bookmark_get en libraries/bookmark.lib.php de phpMyAdmin v2.11.x y anteriores a v2.11.11.3, y v3.3.x anteriores a v3.3.9.2,no restringe adecuadamente las consultas de bookmark, lo que hace más fácil ... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 0CVE-2010-4481
https://notcve.org/view.php?id=CVE-2010-4481
17 Dec 2010 — phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function. phpMyAdmin anteriores a v3.4.0-beta1, permite a atacantes remotos evitar la autenticación y obtener información sensible a través de una solicitud directa al phpinfo.php, que llama a la función phpinfo. • http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 23%CPEs: 2EXPL: 2CVE-2010-4480 – phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification
https://notcve.org/view.php?id=CVE-2010-4480
08 Dec 2010 — error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]". El archivo error.php en PhpMyAdmin versión 3.3.8.1, y otras versiones anteriores a 3.4.0-beta1, permite a los atacantes remotos conducir ataques de tipo cross-site scripting (XSS), por medio de una etiqueta BBcode creada que contiene caracteres "@", como es demostrado usando "[a@... • https://www.exploit-db.com/exploits/15699 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 64EXPL: 0CVE-2010-4329
https://notcve.org/view.php?id=CVE-2010-4329
02 Dec 2010 — Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la funcion PMA_linkOrButton en libraries/common.lib.php en el script de búsqueda database (db) en phpMyAdmin v2.11.x anterior a v2.11.... • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •