CVSS: 2.6EPSS: 0%CPEs: 75EXPL: 0CVE-2011-2642
https://notcve.org/view.php?id=CVE-2011-2642
Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la vista de implementación en la tabla Print en tbl_printview.php en phpMyAdmin anterior a v3.3.10.3 y v3.4.x anterior a v3.4.3.2 permite a usuarios autenticados de forma remota inyectar código script web de su elección o HTML a través de un nombre de tabla manipulado. • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063418.html http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=4bd27166c314faa37cada91533b86377f4d4d214 http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a0823be05aa5835f207c0838b9cca67d2d9a050a http://secunia.com/advisories/45315 http://secunia.com/advisories/45365 http://secunia.com/advisories/45515 http • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 65EXPL: 0CVE-2010-4481
https://notcve.org/view.php?id=CVE-2010-4481
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function. phpMyAdmin anteriores a v3.4.0-beta1, permite a atacantes remotos evitar la autenticación y obtener información sensible a través de una solicitud directa al phpinfo.php, que llama a la función phpinfo. • http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c http://secunia.com/advisories/42485 http://secunia.com/advisories/42725 http://www.debian.org/security/2010/dsa-2139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php http://www.vupen.com/english/advisories/2010/3238 http://www.vupen.com/english/advisories/2011/0001 http://www.vupen&# • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 177EXPL: 0CVE-2009-2284
https://notcve.org/view.php?id=CVE-2009-2284
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en phpMyAdmin anterior a v3.2.0.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de un favorito con una sentencia SQL manipulada. • http://secunia.com/advisories/35649 http://secunia.com/advisories/35715 http://www.mandriva.com/security/advisories?name=MDVSA-2009:192 http://www.phpmyadmin.net/home_page/security/PMASA-2009-5.php https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00150.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00152.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00256.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2009-1149
https://notcve.org/view.php?id=CVE-2009-1149
CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the (1) c_type and possibly (2) file_type parameters. Vulnerabilidad de inyección CRLF en el archivo bs_disp_as_mime_type.php en la característica BLOB streaming en phpMyAdmin anteriores a v3.1.3.1 permite a los atacantes remotos inyectar arbitrariamente cabeceras HTTP y llevar a cabo ataques de separación de respuesta HTTP a través de los parámetros (1) c_type y posiblemente (2) file_type • http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/bs_disp_as_mime_type.php?r1=12303&r2=12302&pathrev=12303 http://secunia.com/advisories/34468 http://secunia.com/advisories/34642 http://www.phpmyadmin.net/home_page/security/PMASA-2009-1.php • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 88%CPEs: 41EXPL: 3CVE-2009-1151 – phpMyAdmin Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-1151
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Vulnerabilidad de inyección de código estático en el archivo setup.php en phpMyAdmin v2.11.x anteriores a v2.11.9.5 y v3.x anteriores a v3.1.3.1 que permite a los atacantes remotos inyectar código PHP arbitrariamente en el archivo de configuración a través de la acción guardar. Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file. • https://www.exploit-db.com/exploits/8921 https://www.exploit-db.com/exploits/8992 https://www.exploit-db.com/exploits/16913 http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/scripts/setup.php?r1=11514&r2=12301&pathrev=12301 http://secunia.com/advisories/34430 http://secunia.com/advisories/34642 http://secunia& • CWE-94: Improper Control of Generation of Code ('Code Injection') •