CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7260
https://notcve.org/view.php?id=CVE-2018-7260
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Una vulnerabilidad Cross-Site Scripting (XSS) en db_central_columns.php en phpMyAdmin, en versiones anteriores a la 4.7.8, permite que atacantes remotos autenticados inyecten scripts web o HTLM arbitrarios mediante una URL manipulada. • http://www.securityfocus.com/bid/103099 https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3 https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-in-phpmyadmin https://www.phpmyadmin.net/security/PMASA-2018-1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 0%CPEs: 36EXPL: 0CVE-2016-6621
https://notcve.org/view.php?id=CVE-2016-6621
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors. La secuencia de comandos de instalación para phpMyAdmin en versiones anteriores a 4.0.10.19, 4.4.x en versiones anteriores a 4.4.15.10 y 4.6.x en versiones anteriores a 4.6.6 permite a atacantes remotos realizar ataques de falsificación de solicitud del lado del servidor (SSRF) a través de vectores no especificados. • http://www.securityfocus.com/bid/95914 https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html https://www.phpmyadmin.net/security/PMASA-2016-44 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5097
https://notcve.org/view.php?id=CVE-2016-5097
phpMyAdmin before 4.6.2 places tokens in query strings and does not arrange for them to be stripped before external navigation, which allows remote attackers to obtain sensitive information by reading (1) HTTP requests or (2) server logs. phpMyAdmin en versiones anteriores a 4.6.2 emplaza tokens en cadenas de consulta y no gestiona su eliminación antes de la navegación externa, lo que permite a atacantes remotos obtener información sensible leyendo (1) peticiones HTTP o (2) los registros del servidor. • http://lists.opensuse.org/opensuse-updates/2016-06/msg00043.html http://www.securitytracker.com/id/1035978 https://github.com/phpmyadmin/phpmyadmin/commit/11eb574242d2526107366d367ab5585fbe29578f https://github.com/phpmyadmin/phpmyadmin/commit/59e56bd63a5e023b797d82eb272cd074e3b4bfd1 https://github.com/phpmyadmin/phpmyadmin/commit/5fc8020c5ba9cd2e38beb5dfe013faf2103cdf0f https://github.com/phpmyadmin/phpmyadmin/commit/8326aaebe54083d9726e153abdd303a141fe5ad3 https://security.gentoo.org/glsa/201701-32 https://www.phpmyadmin.net/security/PMASA-2016-14 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 7EXPL: 0CVE-2011-3591
https://notcve.org/view.php?id=CVE-2011-3591
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js. Múltiples vulnerabilidades XSS en phpMyAdmin 3.4.x anterior a 3.4.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML através de una fila modificada que lanza un mensaje de confirmación erróneamente construido después de una edición en una línea y operaciones de guardar, relacionado con (1) js/functions.js y (2) js/tbl_structure.js. • http://www.openwall.com/lists/oss-security/2011/09/30/8 http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php https://bugzilla.redhat.com/show_bug.cgi?id=738681 https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 7EXPL: 0CVE-2011-3592
https://notcve.org/view.php?id=CVE-2011-3592
Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation. Múltiples vulnerabilidades XSS en la función PMA_unInlineEditRow en js/sql.js en phpMyAdmin 3.4.x anterior a 3.4.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML a través de (1) el nombre de la base de datos, (2) el nombre de la tabla o (3) el nombre de la columna por un tratamiento indebido después de la operación de edición de líneas. • http://www.openwall.com/lists/oss-security/2011/09/30/8 http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php https://bugzilla.redhat.com/show_bug.cgi?id=738681 https://github.com/phpmyadmin/phpmyadmin/commit/2f28ce9c800274190418da0945ce3647d36e1db6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •