Show filters
69 Total Results
Displaying 61-69 of 69
Sort by:
Attacker Value
Unknown
CVE-2016-2040
Disclosure Date: February 20, 2016 (last updated November 25, 2024)
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
0
Attacker Value
Unknown
CVE-2016-1927
Disclosure Date: February 20, 2016 (last updated November 25, 2024)
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
0
Attacker Value
Unknown
CVE-2016-2039
Disclosure Date: February 20, 2016 (last updated November 25, 2024)
libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
0
Attacker Value
Unknown
CVE-2016-2038
Disclosure Date: February 20, 2016 (last updated November 25, 2024)
phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
0
Attacker Value
Unknown
CVE-2015-8669
Disclosure Date: December 26, 2015 (last updated November 25, 2024)
libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
0
Attacker Value
Unknown
CVE-2015-7873
Disclosure Date: October 28, 2015 (last updated October 05, 2023)
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
0
Attacker Value
Unknown
CVE-2015-6830
Disclosure Date: September 14, 2015 (last updated October 05, 2023)
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
0
Attacker Value
Unknown
CVE-2015-3902
Disclosure Date: May 26, 2015 (last updated October 05, 2023)
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
0
Attacker Value
Unknown
CVE-2015-3903
Disclosure Date: May 26, 2015 (last updated October 05, 2023)
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
0
