CVSS: 5.0EPSS: 0%CPEs: 65EXPL: 0CVE-2010-4481
https://notcve.org/view.php?id=CVE-2010-4481
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function. phpMyAdmin anteriores a v3.4.0-beta1, permite a atacantes remotos evitar la autenticación y obtener información sensible a través de una solicitud directa al phpinfo.php, que llama a la función phpinfo. • http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c http://secunia.com/advisories/42485 http://secunia.com/advisories/42725 http://www.debian.org/security/2010/dsa-2139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php http://www.vupen.com/english/advisories/2010/3238 http://www.vupen.com/english/advisories/2011/0001 http://www.vupen&# • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 2CVE-2010-4480 – phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification
https://notcve.org/view.php?id=CVE-2010-4480
error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]". El archivo error.php en PhpMyAdmin versión 3.3.8.1, y otras versiones anteriores a 3.4.0-beta1, permite a los atacantes remotos conducir ataques de tipo cross-site scripting (XSS), por medio de una etiqueta BBcode creada que contiene caracteres "@", como es demostrado usando "[a@url@page] ". • https://www.exploit-db.com/exploits/15699 http://secunia.com/advisories/42485 http://secunia.com/advisories/42725 http://www.debian.org/security/2010/dsa-2139 http://www.exploit-db.com/exploits/15699 http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 http://www.phpmyadmin.net/home_page/security/PMASA-2010-9.php http://www.securityfocus.com/bid/45633 http://www.vupen.com/english/advisories/2010/3133 http://www.vupen.com/english/advisories/2011/0001 http: • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2010-4329
https://notcve.org/view.php?id=CVE-2010-4329
Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la funcion PMA_linkOrButton en libraries/common.lib.php en el script de búsqueda database (db) en phpMyAdmin v2.11.x anterior a v2.11.11.1 y v3.x anterior a v3.3.8.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una solicitud manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8 http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4 http://secunia.com/advisories/42408 http://secunia.com/advisories/42477 http://secunia.com/advisories/42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 0CVE-2010-3263
https://notcve.org/view.php?id=CVE-2010-3263
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en setup/frames/index.inc.php en el ficheros de comandos de configuración en phpMyAdmin v3.x anteriores a v3.3.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del nombre del servidor. • http://secunia.com/advisories/41210 http://www.mandriva.com/security/advisories?name=MDVSA-2010:186 http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php https://exchange.xforce.ibmcloud.com/vulnerabilities/61675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0CVE-2010-2958
https://notcve.org/view.php?id=CVE-2010-2958
Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en libraries/Error.class.php en phpMyAdmin v3.x anterior a v3.3.6, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores relacionados con un backtrace y mensajes de error (también conocidos como mensajes de depuración). Vulnerabilidad distinta de CVE-2010-3056. • http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37 http://secunia.com/advisories/41206 http://www.openwall.com/lists/oss-security/2010/09/01/2 http://www.openwall.com/lists/oss-security/2010/09/01/3 http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php http://www.vupen.com/english/advisories/2010/2242 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •