CVSS: 6.5EPSS: 4%CPEs: 69EXPL: 0CVE-2011-0987
https://notcve.org/view.php?id=CVE-2011-0987
The PMA_Bookmark_get function in libraries/bookmark.lib.php in phpMyAdmin 2.11.x before 2.11.11.3, and 3.3.x before 3.3.9.2, does not properly restrict bookmark queries, which makes it easier for remote authenticated users to trigger another user's execution of a SQL query by creating a bookmark. La función PMA_Bookmark_get en libraries/bookmark.lib.php de phpMyAdmin v2.11.x y anteriores a v2.11.11.3, y v3.3.x anteriores a v3.3.9.2,no restringe adecuadamente las consultas de bookmark, lo que hace más fácil para los usuarios remotos autenticados activar la ejecución de una consulta SQL de otro usuario mediante la creación de un marcador. • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054349.html http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054525.html http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=a5464b4daff0059cdf8c9e5f4d54a80e2dd2a5b0 http://secunia.com/advisories/43324 http://secunia.com/advisories/43391 http://secunia.com/advisories/43478 http://www.debian.org/security/2011 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 65EXPL: 0CVE-2010-4481
https://notcve.org/view.php?id=CVE-2010-4481
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function. phpMyAdmin anteriores a v3.4.0-beta1, permite a atacantes remotos evitar la autenticación y obtener información sensible a través de una solicitud directa al phpinfo.php, que llama a la función phpinfo. • http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4d9fd005671b05c4d74615d5939ed45e4d019e4c http://secunia.com/advisories/42485 http://secunia.com/advisories/42725 http://www.debian.org/security/2010/dsa-2139 http://www.mandriva.com/security/advisories?name=MDVSA-2011:000 http://www.phpmyadmin.net/home_page/security/PMASA-2010-10.php http://www.vupen.com/english/advisories/2010/3238 http://www.vupen.com/english/advisories/2011/0001 http://www.vupen&# • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2010-4329
https://notcve.org/view.php?id=CVE-2010-4329
Cross-site scripting (XSS) vulnerability in the PMA_linkOrButton function in libraries/common.lib.php in the database (db) search script in phpMyAdmin 2.11.x before 2.11.11.1 and 3.x before 3.3.8.1 allows remote attackers to inject arbitrary web script or HTML via a crafted request. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la funcion PMA_linkOrButton en libraries/common.lib.php en el script de búsqueda database (db) en phpMyAdmin v2.11.x anterior a v2.11.11.1 y v3.x anterior a v3.3.8.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una solicitud manipulada. • http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051942.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051956.html http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=4341818d73d454451f024950a4ce0141608ac7f8 http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commitdiff%3Bh=e1f4901ffc400b6d2df15eac0ba5015fe48a27c4 http://secunia.com/advisories/42408 http://secunia.com/advisories/42477 http://secunia.com/advisories/42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 0CVE-2010-3263
https://notcve.org/view.php?id=CVE-2010-3263
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en setup/frames/index.inc.php en el ficheros de comandos de configuración en phpMyAdmin v3.x anteriores a v3.3.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del nombre del servidor. • http://secunia.com/advisories/41210 http://www.mandriva.com/security/advisories?name=MDVSA-2010:186 http://www.phpmyadmin.net/home_page/security/PMASA-2010-7.php https://exchange.xforce.ibmcloud.com/vulnerabilities/61675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •