CVSS: 2.6EPSS: 0%CPEs: 82EXPL: 0CVE-2007-6100
https://notcve.org/view.php?id=CVE-2007-6100
Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992. Vulnerabilidad de secuencias de comandos en sitios cruzados(XSS) en el fichero libraries/auth/cookie.auth.lib.php de phpMyAdmin, en versiones previas a la 2.11.2.2. Cuando los inicios de sesión son autenticados con la cookie auth_type, la vulnerabilidad permite que atacantes remotos inyecten, a su elección, códigos web o HTML en index.php a través del parámetro convcharset. Una vulnerabilidad distinta a CVE-2005-0992. • http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://secunia.com/advisories/27748 http://secunia.com/advisories/29323 http://www.nth-dimension.org.uk/pub/NDSA20071119.txt.asc http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-8 http://www.securityfocus.com/bid/26513 http://www.vupen.com/english/advisories/2007/3943 https://exchange.xforce.ibmcloud.com/vulnerabilities/38601 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5976
https://notcve.org/view.php?id=CVE-2007-5976
SQL injection vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to execute arbitrary SQL commands via the db parameter. Vulnerabilidad de inyección SQL en el db_create.php en el phpMyAdmin anterior al 2.11.2.1 permite a usuarios remotos autenticados con privilegios de CREATE DATABASE ejecutar comandos SQL de su elección a través del parámetro db. • http://secunia.com/advisories/27630 http://secunia.com/advisories/27753 http://sourceforge.net/project/shownotes.php?release_id=553333 http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html http://www.mandriva.com/security/advisories?name=MDKSA-2007:229 http://www.securityfocus.com/bid/26512 http://www.vupen.com/english/advisories/2007/3824 https://exchange.xforce.ibmcloud.com/vulnerabilities/38403 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00777.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5977
https://notcve.org/view.php?id=CVE-2007-5977
Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el db_create.php del phpMyAdmin anterior al 2.11.2.1 permite a usuarios remotos autenticados con privilegios de CREATE DATABASE la inyección de secuencias de comandos web o HTML de su elección a través de un elemento IMG con codificación hex en el parámetro db de una petición POST. Vulnerabilidad diferente a la CVE-2006-6942. • http://secunia.com/advisories/27630 http://secunia.com/advisories/27753 http://sourceforge.net/project/shownotes.php?release_id=553333 http://www.digitrustgroup.com/advisories/tdg-advisory071108a.html http://www.mandriva.com/security/advisories?name=MDKSA-2007:229 http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2007-7 http://www.securityfocus.com/bid/26512 http://www.vupen.com/english/advisories/2007/3824 https://exchange.xforce.ibmcloud.com/vulnerabilities/38404 https://www. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 1CVE-2007-5589 – phpMyAdmin 2.11.1 - 'Server_Status.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-5589
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in (1) PHP_SELF in (a) server_status.php, and (b) grab_globals.lib.php, (c) display_change_password.lib.php, and (d) common.lib.php in libraries/; and certain input available in PHP_SELF and (2) PATH_INFO in libraries/common.inc.php. NOTE: there might also be other vectors related to (3) REQUEST_URI. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en phpMyAdmin versiones anteriores a 2.11.1.2, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio de cierta entrada disponible en (1) PHP_SELF en (a) el archivo server_status.php, y las bibliotecas (b) grab_globals.lib.php, (c) display_change_password.lib.php y (d) common.lib.php en libraries/; y ciertas entradas disponibles en PHP_SELF y (2) PATH_INFO en la biblioteca libraries/common.inc.php. NOTA: también puede haber otros vectores relacionados con (3) REQUEST_URI. • https://www.exploit-db.com/exploits/30733 http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://osvdb.org/37939 http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_1/phpMyAdmin/ChangeLog?r1=10796&r2=10795&pathrev=10796 http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin?view=rev&revision=10796 http://secunia.com/advisories/27246 http://secunia.com/advisories/27506 http://secunia.com/advisories/27595 http://secunia.com/advisories/29323 h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 8%CPEs: 22EXPL: 1CVE-2007-1395
https://notcve.org/view.php?id=CVE-2007-1395
Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase </SCRIPT> end tag, which bypasses the protection against lowercase </script>. Vulnerabilidad de lista negra incompleta en index.php en phpMyAdmin 2.8.0 hasta 2.9.2 permite a atacantes remotos llevar a cabo ataques de secuencias de comandos de sitios cruzados (XSS) por inyección de JavaScript de su elección o HTML en un valor parámetro (1)db o (2) table seguido de una etiqueta de fin "mayúscula" </SCRIPT>, la cual evita la protección contra la "minúscula" </script>. • http://osvdb.org/35048 http://secunia.com/advisories/26733 http://securityreason.com/securityalert/2402 http://www.mandriva.com/security/advisories?name=MDKSA-2007:199 http://www.securityfocus.com/archive/1/462139/100/0/threaded http://www.us.debian.org/security/2007/dsa-1370 http://www.virtuax.be/advisories/Advisory2-24012007.txt https://exchange.xforce.ibmcloud.com/vulnerabilities/32858 •