CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 2CVE-2019-12616 – phpMyAdmin 4.8 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-12616
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. Un problema fue descubierto en phpMyAdmin antes del 4.9.0. Fue descubierta una vulnerabilidad que permite a un atacante desencadenar un ataque CSRF contra un usuario de phpMyAdmin. • https://www.exploit-db.com/exploits/46982 https://github.com/Cappricio-Securities/CVE-2019-12616 http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html http://packetstormsecurity.com/files/153251/phpMyAdmin-4.8-Cross-Site-Request-Forgery.html http://www.securityfocus.com/bid/108619 https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html https://lists.fedoraproject.org/archives/list/package-ann • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2019-11768
https://notcve.org/view.php?id=CVE-2019-11768
An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. Fue descubierto un problema en phpMyAdmin anterior de la versión d 4.9.0.1. Se informó de una vulnerabilidad en la que se puede utilizar un nombre de base de datos especialmente diseñado para desencadenar un ataque de inyección de SQL a través de la función del diseñador. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00017.html http://www.securityfocus.com/bid/108617 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/II4HC4QO6WUL2IRSQKCB66UBJOLLI5OV https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKJMYVXEDXGEGRO42T6H6VOEZJ65QPQ7 https://www.phpmyadmin.net/security/PMASA-2019-3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6798
https://notcve.org/view.php?id=CVE-2019-6798
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature. Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Se ha detectado una vulnerabilidad en la que un nombre de usuario especialmente manipulado puede emplearse para provocar un ataque de inyección SQL mediante la funcionalidad "designer". • http://www.securityfocus.com/bid/106727 https://www.phpmyadmin.net/security/PMASA-2019-2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.9EPSS: 11%CPEs: 2EXPL: 0CVE-2019-6799
https://notcve.org/view.php?id=CVE-2019-6799
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls. Se ha descubierto un problema en phpMyAdmin en versiones anteriores a la 4.8.5. Cuando el ajuste de configuración "AllowArbitraryServer" se establece en "true" con el uso de un servidor MySQL no autorizado, un atacante puede leer cualquier archivo en el servidor que sea accesible por cualquier usuario del servido web. • http://www.securityfocus.com/bid/106736 https://lists.debian.org/debian-lts-announce/2019/02/msg00039.html https://www.phpmyadmin.net/security/PMASA-2019-1 •
CVSS: 6.1EPSS: 7%CPEs: 2EXPL: 0CVE-2018-19970
https://notcve.org/view.php?id=CVE-2018-19970
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name. En phpMyAdmin, en versiones anteriores a la 4.8.4, se ha encontrado una vulnerabilidad Cross-Site Scripting (XSS) en el árbol de navegación, donde un atacante puede entregar una carga útil a un usuario mediante un nombre de base de datos/tabla manipulado. • http://www.securityfocus.com/bid/106181 https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html https://security.gentoo.org/glsa/201904-16 https://www.phpmyadmin.net/security/PMASA-2018-8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •