Updated phpmyadmin packages fix security vulnerability

Some SQL injections via table names and parameters were fixed...

Sql injection

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

U.S. Dept Of Defense: Followup - SQL Injection - https://██████████/██████/MSI.portal

Summary: Time based blind sql injection for parameter MSIadditionalFilterType1, at the following URL: https://███/███/MSI.portal?nfpb=true&pageLabel=msiportalpage61 Description: This is a follow up to a previous report I submitted: https://hackerone.com/reports/674838 The following page has a for...

Pydio Cells Information Disclosure Vulnerability

Pydio Cells is a transitional application for managing files on a Pydio Cells 1.2.X server. An information disclosure vulnerability exists in versions of Pydio Cells prior to 1.5.0, which stems from Pydio Cells failing to properly handle a Name field that is not in the expected Unicode format and...

CVE-2019-0278

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration Messaging System, fixed in versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to see the names of database tables used by the application, leading to information disclosure...

SUSE-SU-2018:3770-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: Security issue fixed: - CVE-2018-16850: Fixed improper quoting of transition table names when pgdump emits CREATE TRIGGER could have caused privilege escalation bsc1114837. Non-security issues fixed: - Update to release 10.6:...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

CVE-2017-1000005

PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data stealing data...

PHPMiniAdmin Stored Cross-Site Scripting Vulnerability

PHPMiniAdmin is a lightweight MySQL database management tool written in PHP. The tool supports common functions such as importing and exporting databases and executing SQL statements. A cross-site scripting vulnerability exists in database names, table names, and column names in PHPMiniAdmin...

mysql: Incorrect input validation allowing code execution via mysqldump

It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or tables could cause the mysql command to execute arbitrary shell or SQL commands while restoring database...

MariaDB Server 5.5.x < 5.5.47 / 10.0.x < 10.0.23 / 10.1.x < 10.1.10 Multiple Vulnerabilities

Binary data 9287.prm...

phpMyAdmin cross-site scripting vulnerability (CNVD-2016-01415)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A cross-site scripting vulnerability exists in...

The vulnerability of the Cisco Unified Communications Manager system allows a perpetrator to access information related to table names and database entities.

The vulnerability of the Cisco Unified Communications Manager IP-telephony management system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to information about table names and database...

CVE-2016-1317

Cisco Unified Communications Manager 11.50.98000.480 allows remote authenticated users to obtain sensitive database table-name and entity-name information via a direct request to an unspecified URL, aka Bug ID CSCuy11098...

Multiple XSS vulnerabilities.

PMASA-2016-3 Announcement-ID: PMASA-2016-3 Date: 2016-01-24 Summary Multiple XSS vulnerabilities. Description With a crafted table name it is possible to trigger an XSS attack in the database search page. With a crafted SET value or a crafted search query, it is possible to trigger an XSS attacks...

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection

vBulletin 3.6.0 4.2.3 - ForumRunner SQL Injection Exploit Title : vBulletin = 4.2.3 SQL Injection CVE-2016-6195 Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 25/08/2015 Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu...

phpcms v9 latest high-risk sql injection exp-vulnerability warning-the black bar safety net

Get the current database http://192.168.1.139:8080/phpcms/index.php?m=member&c=index&a=login post: forward=http%253A%252F%252F192. 1 6 8. 1. 1 3 9%253A8080%252Fphpcms%252Findex. php%253Fm%253Dmember&username=phpcms&password=1 2 3 4 5 6%26username%3d%2 5 2 7%2bunion%2bselect%2b%2 5 2 7 2% 2 5 2...

php: NULL pointer dereference in php_pgsql_meta_data()

The phppgsqlmetadata function in pgsql.c in the PostgreSQL aka pgsql extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service NULL pointer dereference and...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory. Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass...

php: NULL pointer dereference in php_pgsql_meta_data()

The phppgsqlmetadata function in pgsql.c in the PostgreSQL aka pgsql extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service NULL pointer dereference and...