CVE-2016-10025

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions aka SVM allows local HVM guest OS users to cause a denial of service hypervisor crash by leveraging a missing NULL pointer check...

CVE-2016-6897

Cross-site request forgery CSRF vulnerability in the wpajaxupdateplugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the checkajaxreferer...

November 2016 Preview of Quality Rollup for the .NET Framework 3.5, 4.5.2, 4.6, 4.6.1 on Windows Server 2012 (KB3195383)

November 2016 Preview of Quality Rollup for the .NET Framework 3.5, 4.5.2, 4.6, 4.6.1 on Windows Server 2012 KB3195383 This update is superseded by the December 13, 2016, Quality Rollup 3205403. Note There is a known issue in this update. For more information, see KB 3214106.The November 2016...

November 2016 Preview of Quality Rollup for the .NET Framework 2.0 SP2, 4.5.2, 4.6 on Windows Vista SP2 and Windows Server 2008 SP2 (KB3195382): November 15, 2016

November 2016 Preview of Quality Rollup for the .NET Framework 2.0 SP2, 4.5.2, 4.6 on Windows Vista SP2 and Windows Server 2008 SP2 KB3195382: November 15, 2016 This update is superseded by the December 13, 2016, Quality Rollup 3210142. Note There is a known issue in this update. For more...

November 2016 Preview of Quality Rollup for the .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1 on Windows 7 SP1 and Windows Server 2008 R2 SP1 (KB3196686)

November 2016 Preview of Quality Rollup for the .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1 on Windows 7 SP1 and Windows Server 2008 R2 SP1 KB3196686 This update is superseded by the December 13, 2016, Quality Rollup 3205402. Note There is a known issue in this update. For more information, see KB...

MS16-035: Description of the security update for the .NET Framework 4.6 and 4.6.1 in Windows Server 2012: March 8, 2016

MS16-035: Description of the security update for the .NET Framework 4.6 and 4.6.1 in Windows Server 2012: March 8, 2016 November 8, 2016 A detection change was made to account for the .NET Framework 4.6.1 hotfix rollup for customers who were not being correctly offered this security update for th...

phpMyAdmin SQL Injection Vulnerability (CNVD-2016-13238)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A SQL injection vulnerability exists in phpMyAdmin versions 4.6.x prior to 4.6.4 and 4.4.x prior to 4.4.15.8. The vulnerability can be exploited to execute arbitrary SQL injection commands via the Use...

CVE-2016-10025

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions aka SVM allows local HVM guest OS users to cause a denial of service hypervisor crash by leveraging a missing NULL pointer check...

phpMyAdmin 4.0.10.x < 4.0.10.18 / 4.4.15.x < 4.4.15.9 / 4.6.x < 4.6.5 Multiple Vulnerabilities

Binary data 9830.prm...

DEBIAN-CVE-2016-9863

An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service DoS attack. All 4.6.x versions prior to 4.6.5 are affected...

Code injection

An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and ...

Cross site request forgery (csrf)

An issue was discovered in phpMyAdmin. When the argseparator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to...

ALPINE-CVE-2016-9860

An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg'AllowArbitraryServer'=true. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

Code injection

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions prior to 4.6.5 are affected...

CVE-2016-9857

An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

DEBIAN-CVE-2016-9856

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...

ALPINE-CVE-2016-9854

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

DEBIAN-CVE-2016-9853

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the expo...

ALPINE-CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

ALPINE-CVE-2016-6631

An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file...