CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19617
https://notcve.org/view.php?id=CVE-2019-19617
06 Dec 2019 — phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. phpMyAdmin versiones anteriores a 4.9.2 no escapa determinada información de Git, relacionada con las bibliotecas libraries/classes/Display/GitRevision.php y libraries/classes/Footer.php. • https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9 •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18622 – Gentoo Linux Security Advisory 202003-39
https://notcve.org/view.php?id=CVE-2019-18622
22 Nov 2019 — An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. Se detectó un problema en phpMyAdmin versiones anteriores a 4.9.2. Se puede utilizar un nombre de base de datos/tabla diseñado para desencadenar un ataque de inyección SQL por medio de la funcionalidad designer. An SQL injection vulnerability in phpMyAdmin may allow attackers to execute arbitrary SQL statements. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 80%CPEs: 4EXPL: 4CVE-2019-12922 – phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12922
13 Sep 2019 — A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. Un problema de tipo CSRF en phpMyAdmin versión 4.9.0.1, permite la eliminación de cualquier servidor en la página de Setup. phpMyAdmin version 4.9.0.1 suffers from a cross site request forgery vulnerability. • https://packetstorm.news/files/id/154483 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 3CVE-2019-12616 – phpMyAdmin 4.8 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12616
05 Jun 2019 — An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. Un problema fue descubierto en phpMyAdmin antes del 4.9.0. Fue descubierta una vulnerabilidad que permite a un atacante desen... • https://packetstorm.news/files/id/153251 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11768 – Ubuntu Security Notice USN-4639-1
https://notcve.org/view.php?id=CVE-2019-11768
05 Jun 2019 — An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. Fue descubierto un problema en phpMyAdmin anterior de la versión d 4.9.0.1. Se informó de una vulnerabilidad en la que se puede utilizar un nombre de base de datos especialmente diseñado para desencadenar un ataque de inyección de SQL a través de la función del diseñador. It was discovered that there was a bug ... • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.9EPSS: 8%CPEs: 2EXPL: 0CVE-2019-6799 – Ubuntu Security Notice USN-4639-1
https://notcve.org/view.php?id=CVE-2019-6799
26 Jan 2019 — An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls. Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Cuando el ajuste de configuración "AllowArbitrarySe... • http://www.securityfocus.com/bid/106736 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6798
https://notcve.org/view.php?id=CVE-2019-6798
26 Jan 2019 — An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature. Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Se ha detectado una vulnerabilidad en la que un nombre de usuario especialmente manipulado puede emplearse para provocar un ataque de inyección SQL mediante la funcionalidad "designer". • http://www.securityfocus.com/bid/106727 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 14%CPEs: 2EXPL: 0CVE-2018-19968 – Ubuntu Security Notice USN-4639-1
https://notcve.org/view.php?id=CVE-2018-19968
11 Dec 2018 — An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system. Un atacante puede explotar phpMyAdmin en versiones anteriores a la 4... • http://www.securityfocus.com/bid/106178 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 3%CPEs: 2EXPL: 0CVE-2018-19970 – Ubuntu Security Notice USN-4639-1
https://notcve.org/view.php?id=CVE-2018-19970
11 Dec 2018 — In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name. En phpMyAdmin, en versiones anteriores a la 4.8.4, se ha encontrado una vulnerabilidad Cross-Site Scripting (XSS) en el árbol de navegación, donde un atacante puede entregar una carga útil a un usuario mediante un nombre de base de datos/tabla manipulado. It was discovered that there was a bug in the way phpMyAdmin handles the phpMyAdmin ... • http://www.securityfocus.com/bid/106181 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-19969 – Gentoo Linux Security Advisory 201904-16
https://notcve.org/view.php?id=CVE-2018-19969
11 Dec 2018 — phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc. phpMyAdmin, en versiones 4.7.x y 4.8.x anteriores a la 4.8.4, se ha visto afectado por una serie de errores Cross-Site Request Forgery (CSRF). Al engañar a un us... • http://www.securityfocus.com/bid/106175 • CWE-352: Cross-Site Request Forgery (CSRF) •