CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-19969
https://notcve.org/view.php?id=CVE-2018-19969
phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc. phpMyAdmin, en versiones 4.7.x y 4.8.x anteriores a la 4.8.4, se ha visto afectado por una serie de errores Cross-Site Request Forgery (CSRF). Al engañar a un usuario para que haga clic en una URL maliciosa, es posible realizar operaciones SQL dañinas, como renombrar bases de datos, crear nuevas tablas/rutinas, eliminar páginas del diseñador, añadir/eliminar usuarios, actualizar contraseñas de usuarios, matar procesos SQL, etc. • http://www.securityfocus.com/bid/106175 https://security.gentoo.org/glsa/201904-16 https://www.phpmyadmin.net/security/PMASA-2018-7 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 24%CPEs: 2EXPL: 0CVE-2018-19968
https://notcve.org/view.php?id=CVE-2018-19968
An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system. Un atacante puede explotar phpMyAdmin en versiones anteriores a la 4.8.4 para filtrar el contenido de un archivo local debido a un error en la característica de transformación. El atacante debe tener acceso a las tablas de configuración "Configuration Storage" de phpMyAdmin, aunque pueden crearse fácilmente en cualquier base de datos a la que tenga acceso. • http://www.securityfocus.com/bid/106178 https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html https://security.gentoo.org/glsa/201904-16 https://www.phpmyadmin.net/security/PMASA-2018-6 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15605
https://notcve.org/view.php?id=CVE-2018-15605
An issue was discovered in phpMyAdmin before 4.8.3. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted file to manipulate an authenticated user who loads that file through the import feature. Se ha descubierto un problema en versiones anteriores a la 4.8.3 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un archivo manipulado para manipular un usuario autenticado que cargue ese archivo mediante la característica de importación. • http://www.securityfocus.com/bid/105168 http://www.securitytracker.com/id/1041548 https://github.com/phpmyadmin/phpmyadmin/commit/00d90b3ae415b31338f76263359467a9fbebd0a1 https://www.phpmyadmin.net/security/PMASA-2018-5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12581
https://notcve.org/view.php?id=CVE-2018-12581
An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature. Se ha descubierto un problema en js/designer/move.js en versiones anteriores a la 4.8.2 de phpMyAdmin. Se ha encontrado una vulnerabilidad de Cross-Site Scripting (XSS) en la que un atacante puede emplear un nombre de base de datos manipulado para desencadenar un ataque XSS cuando se referencia esa base de datos desde la característica Designer. • http://www.securityfocus.com/bid/104530 http://www.securitytracker.com/id/1041187 https://www.phpmyadmin.net/security/PMASA-2018-3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-18264
https://notcve.org/view.php?id=CVE-2017-18264
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument. Se ha descubierto un problema en libraries/common.inc.php en phpMyAdmin en versiones 4.0 anteriores a la 4.0.10.20, 4.4.x, 4.6.x y 4.7.0 "prereleases". • http://www.securityfocus.com/bid/97211 https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html https://www.phpmyadmin.net/security/PMASA-2017-8 •