CVSS: 6.8EPSS: 0%CPEs: 11EXPL: 4CVE-2006-6942 – phpMyAdmin 2.x - 'db_create.php?db' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-6942
Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en PhpMyAdmin versiones anteriores a 2.9.1.1 permite a atacantes remotos inyectar scripts web o HTML de su elección mediante (1) un comentario en un nombre de talba, tal y como se explota a través de (a) db_operations.php, (2) el parámetro db en (b) db_create.php, (3) el parámetro newname en db_operations.php, el parámetro(4) query_history_latest, (5) query_history_latest_db, y (6) querydisplay_tab en (c) querywindow.php, y (7) el parámetro pos en(d) sql.php. • https://www.exploit-db.com/exploits/29058 https://www.exploit-db.com/exploits/29059 https://www.exploit-db.com/exploits/29060 https://www.exploit-db.com/exploits/29061 http://marc.info/?l=bugtraq&m=116370414309444&w=2 http://secunia.com/advisories/26733 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7 http://www.securityfocus.com/bid/21137 http://www.us.debian.org/security/2007/dsa-1370 http://www.vupen.com/english/advisories/2006/4572 https&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 1CVE-2006-6943 – phpMyAdmin 2.x - Multiple Script Array Handling Full Path Disclosures
https://notcve.org/view.php?id=CVE-2006-6943
PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php. PhpMyAdmin en versiones anteriores a 2.9.1.1 permite a atacantes remotos obtener la ruta completa del servidor a través de peticiones directas a (a) scripts/check_lang.php y (b) themes/darkblue_orange/layout.inc.php; y a través de los argumentos de array (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[] y (6) tbl_group[] en (c) index.php y el argumento (7) back[] en(d) sql.php; y un parámetro no válido (8) sort_by en (e) server_databases.php y (9) el parámetro db en (f) db_printview.php. • https://www.exploit-db.com/exploits/29062 http://marc.info/?l=bugtraq&m=116370414309444&w=2 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8 http://www.securityfocus.com/bid/21137 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2006-6944
https://notcve.org/view.php?id=CVE-2006-6944
phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers. phpMyAdmin versiones anteriores a 2.9.1.1 permite a atacantes remotos evitar reglas de acceso Permitir/Denegar que usan direcciones IP mediante cabeceras falsas. • http://secunia.com/advisories/26733 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-9 http://www.us.debian.org/security/2007/dsa-1370 http://www.vupen.com/english/advisories/2006/4572 •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1CVE-2007-0341
https://notcve.org/view.php?id=CVE-2007-0341
Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin 2.8.1 y anteriores, al usar Microsoft Internet Explorer 6, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante un URI del tipo javascript: en un estilo CSS en el parámetro convcharset al URI de nivel superior, una vulnerabilidad diferente que CVE-2005-0992. • http://www.securityfocus.com/archive/1/456698/100/0/threaded http://www.securityfocus.com/archive/1/456726/100/0/threaded http://www.virtuax.be/advisories/Advisory1-12012007.txt •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0203
https://notcve.org/view.php?id=CVE-2007-0203
Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en phpMyAdmin versiones anteriores a 2.9.2-rc1 tienen un impacto desconocido y vectores de ataque. • http://osvdb.org/32666 http://secunia.com/advisories/23702 http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 http://www.phpmyadmin.net/home_page/downloads.php?relnotes=0 http://www.securityfocus.com/bid/21987 http://www.vupen.com/english/advisories/2007/0125 •