Page 4 of 35 results (0.004 seconds)

CVSS: 9.8EPSS: 1%CPEs: 50EXPL: 0

CVE-2011-2719

https://notcve.org/view.php?id=CVE-2011-2719

01 Aug 2011 — libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505. libraries/auth/swekey/swekey.auth.lib.php en phpMyAdmin v3.x anterior a v3.3.10.3 y v3.4.x anterior a v3.4.3.2 no maneja adecuadame... • http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063410.html • CWE-20: Improper Input Validation •

CVSS: 9.8EPSS: 35%CPEs: 48EXPL: 4

CVE-2011-2505 – phpMyAdmin3 (pma3) - Remote Code Execution

https://notcve.org/view.php?id=CVE-2011-2505

14 Jul 2011 — libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability." libraries/auth/swekey/swekey.auth.lib.php en la función de autenticación Swekey en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 as... • https://www.exploit-db.com/exploits/17510 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.8EPSS: 28%CPEs: 48EXPL: 4

CVE-2011-2506 – phpMyAdmin 3.x - Swekey Remote Code Injection

https://notcve.org/view.php?id=CVE-2011-2506

14 Jul 2011 — setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array. setup/lib/ConfigGenerator.class.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 no restringe correctamente la presencia de los delimitadores de cierre de comentario, permitiendo a ata... • https://www.exploit-db.com/exploits/17514 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 8.8EPSS: 3%CPEs: 48EXPL: 2

CVE-2011-2507

https://notcve.org/view.php?id=CVE-2011-2507

14 Jul 2011 — libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array. libraries/server_synchronize.lib.php en la implementación Synchronize en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3... • http://0x6a616d6573.blogspot.com/2011/07/phpmyadmin-fud.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 8.8EPSS: 11%CPEs: 48EXPL: 1

CVE-2011-2508

https://notcve.org/view.php?id=CVE-2011-2508

14 Jul 2011 — Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter. Vulnerabilidad de salto de directorio en libraries/display_tbl.lib.php en phpMyAdmin v3.x anterior a v3.3.10.2 y v3.4.x anterior a v3.4.3.1 cuando una determinada transf... • http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •