CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19617
https://notcve.org/view.php?id=CVE-2019-19617
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php. phpMyAdmin versiones anteriores a 4.9.2 no escapa determinada información de Git, relacionada con las bibliotecas libraries/classes/Display/GitRevision.php y libraries/classes/Footer.php. • https://github.com/phpmyadmin/phpmyadmin/commit/1119de642b136d20e810bb20f545069a01dd7cc9 https://github.com/phpmyadmin/phpmyadmin/compare/RELEASE_4_9_1...RELEASE_4_9_2 https://lists.debian.org/debian-lts-announce/2019/12/msg00006.html https://lists.debian.org/debian-lts-announce/2020/10/msg00024.html https://www.phpmyadmin.net/news/2019/11/22/phpmyadmin-492-released •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-18622
https://notcve.org/view.php?id=CVE-2019-18622
An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature. Se detectó un problema en phpMyAdmin versiones anteriores a 4.9.2. Se puede utilizar un nombre de base de datos/tabla diseñado para desencadenar un ataque de inyección SQL por medio de la funcionalidad designer. • http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BA4DGF7KTQS6WA2DRNJSW66L43WB7LRV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5GW4KEMNCBQYZCIXEJYC42OEBBN2NSH https://security.gentoo.org/glsa/202003-39 https://www.phpmyadmin.net/security/PMASA-2019-5 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 82%CPEs: 4EXPL: 3CVE-2019-12922 – phpMyAdmin 4.9.0.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12922
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. Un problema de tipo CSRF en phpMyAdmin versión 4.9.0.1, permite la eliminación de cualquier servidor en la página de Setup. phpMyAdmin version 4.9.0.1 suffers from a cross site request forgery vulnerability. • https://www.exploit-db.com/exploits/47385 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00078.html http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html http://packetstormsecurity.com/files/154483/phpMyAdmin-4.9.0.1-Cross-Site-Request-Forgery.html http://seclists.org/fulldisclosure/2019/Sep/23 https://github.com/phpmyadmin/phpmyadmin/commit/427fbed55d3154d96ecfc1c7784d49eaa3c04161 https://github.com/phpmyadmin/phpmyadmin/commit/7d21d4223bdbe0306593309132b4263d7087d13b https://lists.fed • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 2CVE-2019-12616 – phpMyAdmin 4.8 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12616
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. Un problema fue descubierto en phpMyAdmin antes del 4.9.0. Fue descubierta una vulnerabilidad que permite a un atacante desencadenar un ataque CSRF contra un usuario de phpMyAdmin. • https://www.exploit-db.com/exploits/46982 https://github.com/Cappricio-Securities/CVE-2019-12616 http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html http://www.securityfocus.com/bid/108619 https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html https://lists.fedoraproject.org/archives/list/package-ann • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-11768
https://notcve.org/view.php?id=CVE-2019-11768
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. Fue descubierto un problema en phpMyAdmin anterior de la versión d 4.9.0.1. Se informó de una vulnerabilidad en la que se puede utilizar un nombre de base de datos especialmente diseñado para desencadenar un ataque de inyección de SQL a través de la función del diseñador. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html http://www.securityfocus.com/bid/108617 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7 https://www.phpmyadmin.net/security/PMASA-2019-3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •