CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2011-3646
https://notcve.org/view.php?id=CVE-2011-3646
phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message. phpmyadmin.css.php en phpMyAdmin v3.4.x anterior a v3.4.6 permite a atacantes remotos obtener información sensible a través de un parámetro jsarray-typed js_frame a phpmyadmin.css.php, lo cual revela la ruta de instalación en un mensaje de error. • http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069234.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069235.html http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069237.html http://secunia.com/advisories/46874 http://www.mandriva.com/security/advisories?name=MDVSA-2011:158 http://www.phpmyadmin.net/home_page/security/PMASA-2011-15.php • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0CVE-2011-3181
https://notcve.org/view.php?id=CVE-2011-3181
Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la característica de Tracking en phpMyAdmin v3.3.x anterior a v3.3.10.4 y 3.4.x anterior a v3.4.4 permite a atacantes remotos inyectar script web de su elección o HTML a través de un (1) nombre de tabla, (2) nombre de columna, o (2) nombre de index. • http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065824.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065829.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065854.html http://secunia.com/advisories/45709 http://secunia.com/advisories/45990 http://www.debian.org/security/2012/dsa-2391 http://www.mandriva.com/security/advisories?name=MDVSA-2011:158 http://www.phpmyadmin.net/home_page/security/PMASA-2011-13.php http: • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •