CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-19969
https://notcve.org/view.php?id=CVE-2018-19969
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc. phpMyAdmin, en versiones 4.7.x y 4.8.x anteriores a la 4.8.4, se ha visto afectado por una serie de errores Cross-Site Request Forgery (CSRF). Al engañar a un usuario para que haga clic en una URL maliciosa, es posible realizar operaciones SQL dañinas, como renombrar bases de datos, crear nuevas tablas/rutinas, eliminar páginas del diseñador, añadir/eliminar usuarios, actualizar contraseñas de usuarios, matar procesos SQL, etc. • http://www.securityfocus.com/bid/106175 https://security.gentoo.org/glsa/201904-16 https://www.phpmyadmin.net/security/PMASA-2018-7 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 7%CPEs: 2EXPL: 0CVE-2018-19970
https://notcve.org/view.php?id=CVE-2018-19970
In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name. En phpMyAdmin, en versiones anteriores a la 4.8.4, se ha encontrado una vulnerabilidad Cross-Site Scripting (XSS) en el árbol de navegación, donde un atacante puede entregar una carga útil a un usuario mediante un nombre de base de datos/tabla manipulado. • http://www.securityfocus.com/bid/106181 https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html https://security.gentoo.org/glsa/201904-16 https://www.phpmyadmin.net/security/PMASA-2018-8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15605
https://notcve.org/view.php?id=CVE-2018-15605
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. Se ha descubierto un problema en versiones anteriores a la 4.8.3 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un archivo manipulado para manipular un usuario autenticado que cargue ese archivo mediante la característica de importación. • http://www.securityfocus.com/bid/105168 http://www.securitytracker.com/id/1041548 https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 https://www.phpmyadmin.net/security/PMASA-2018-5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12581
https://notcve.org/view.php?id=CVE-2018-12581
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature. Se ha descubierto un problema en js/designer/move.js en versiones anteriores a la 4.8.2 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un nombre de base de datos manipulado para desencadenar un ataque XSS cuando se referencia esa base de datos desde la característica Designer. • http://www.securityfocus.com/bid/104530 http://www.securitytracker.com/id/1041187 https://www.phpmyadmin.net/security/PMASA-2018-3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 97%CPEs: 1EXPL: 8CVE-2018-12613 – phpMyAdmin - (Authenticated) Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-12613
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). Se ha descubierto un problema en phpMyAdmin en versiones 4.38.3x anteriores a la 4.8.2 por el cual un atacante puede incluir (ver y, potencialmente, ejecutar) archivos en el servidor. La vulnerabilidad procede de una porción de código en el que las páginas se redirigen y cargan en phpMyAdmin y se realiza una prueba inadecuada para páginas en la lista blanca. • https://www.exploit-db.com/exploits/45020 https://www.exploit-db.com/exploits/50457 https://www.exploit-db.com/exploits/44928 https://www.exploit-db.com/exploits/44924 https://github.com/0x00-0x00/CVE-2018-12613 https://github.com/ivanitlearning/CVE-2018-12613 https://github.com/eastmountyxz/CVE-2018-12613-phpMyAdmin http://packetstormsecurity.com/files/164623/phpMyAdmin-4.8.1-Remote-Code-Execution.html http://www.securityfocus.com/bid/104532 https://security.gentoo.org/glsa/ • CWE-287: Improper Authentication •