CVSS: 5.0EPSS: 0%CPEs: 31EXPL: 0CVE-2015-6830
https://notcve.org/view.php?id=CVE-2015-6830
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha. Vulnerabilidad en libraries/plugins/auth/AuthenticationCookie.class.php en phpMyAdmin 4.3.x en versiones anteriores a 4.3.13.2 y 4.4.x en versiones anteriores a 4.4.14.1, permite a atacantes remotos eludir un mecanismo de protección reCaptcha múltiple contra suposiciones de credenciales por la fuerza aportando una respuesta correcta a un único reCaptcha. • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166294.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166307.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166531.html http://www.debian.org/security/2015/dsa-3382 http://www.securityfocus.com/bid/76674 http://www.securitytracker.com/id/1033546 https://github.com/phpmyadmin/phpmyadmin/commit/785f4e2711848eb8945894199d5870253a88584e https://www.phpmyadmin.net/security/PMASA-2015-4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 0%CPEs: 56EXPL: 0CVE-2015-3902
https://notcve.org/view.php?id=CVE-2015-3902
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file. Múltiples vulnerabilidades de CSRF en el proceso de montaje en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 permiten a atacantes remotos secuestrar la autenticación de administradores para solicitudes que modifican el fichero de configuración. • http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html http://www.debian.org/security/2015/dsa-3382 http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php http://www.securityfocus.com/bid/74657 http://www.securitytracker.com/id/1032404 https://github.com/phpmyadmin/phpmyadmin/commit/ee92eb9bab8e2d546756c1d4aec81ec7c8e44b83 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 56EXPL: 2CVE-2015-3903
https://notcve.org/view.php?id=CVE-2015-3903
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. libraries/Config.class.php en phpMyAdmin 4.0.x anterior a 4.0.10.10, 4.2.x anterior a 4.2.13.3, 4.3.x anterior a 4.3.13.1, y 4.4.x anterior a 4.4.6.1 deshabilita la verificación de los certificados X.509 para las llamadas de API GitHub sobre SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través de un certificado manipulado. • http://cxsecurity.com/issue/WLB-2015050095 http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html http://www.debian.org/security/2015/dsa-3382 http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.securityfocus.com/archive/1/535547/100/0/threaded http://www.securityfocus.com/bid/74660 http://www.securitytracker.com/id/1032403 https://github.com/phpmyadmin/phpmyadmin&#x • CWE-310: Cryptographic Issues •