6879 matches found
Open redirection
PMASA-2016-57 Announcement-ID: PMASA-2016-57 Date: 2016-11-25 Summary Open redirection Description A vulnerability was discovered where a user can be tricked in to following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the...
Multiple XSS vulnerabilities
PMASA-2016-64 Announcement-ID: PMASA-2016-64 Date: 2016-11-25 Updated: 2016-12-06 Summary Multiple XSS vulnerabilities Description Several XSS vulnerabilities have been reported, including an improper fix for PMASA-2016-10 and a weakness in a regular expression using in some JavaScript processing...
Multiple full path disclosure vulnerabilities
PMASA-2016-63 Announcement-ID: PMASA-2016-63 Date: 2016-11-25 Updated: 2016-12-06 Summary Multiple full path disclosure vulnerabilities Description By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which...
CSRF token not stripped from the URL
PMASA-2016-71 Announcement-ID: PMASA-2016-71 Date: 2016-11-25 Updated: 2016-12-06 Summary CSRF token not stripped from the URL Description When the argseparator is different from its default value of &, the token was not properly stripped from the return URL of the preference import action...
Multiple SQL injection vulnerabilities
PMASA-2016-69 Announcement-ID: PMASA-2016-69 Date: 2016-11-25 Updated: 2016-12-06 Summary Multiple SQL injection vulnerabilities Description With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the...
Username deny rules bypass (AllowRoot & Others) by using Null Byte
PMASA-2016-60 Announcement-ID: PMASA-2016-60 Date: 2016-11-25 Updated: 2016-12-06 Summary Username deny rules bypass AllowRoot & Others by using Null Byte Description It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the...
phpMyAdmin -- multiple vulnerabilities
Please reference CVE/URL list for details...
Yahoo Web Security Bug Bounty : Phpmyadmin access make data on risk
Yahoo Web Security Bug Bounty : Phpmyadmin access make data on risk Little Insight: Vulnerability in Yahoo bug bounty data on risk Vulnerable Website: http://tw.page.games.yahoo.net/phpmyadmin/setup/index.php?page=form&formset=LeftframetabLefttables Impact: As you can see in the following...
EasyPHP Devserver 16.1.1 - Cross-Site Request Forgery / Remote Command Execution
Exploit for php platform in category web applications + Credits: John Page aka hyp3rlinx Vendor: =============== www.easyphp.org Product: ============================= EasyPHP Devserver v16.1.1 easyphp-devserver-16.1.1-setup.exe hash: 64184d330a34be9e6c029ffa63c903de A complete WAMP environment f...
EasyPHP Devserver 16.1.1 - Cross-Site Request Forgery Remote Command Execution
EasyPHP Devserver 16.1.1 - Cross-Site Request Forgery Remote Command Execution + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYPHP-DEV-SERVER-REMOTE-CMD-EXECUTION.txt + ISR: ApparitionSec Vendor: ===============...
phpMyAdmin 4.0.x < 4.0.10.17 / 4.4.x < 4.4.15.8 / 4.6.x < 4.6.4 Multiple Vulnerabilities (PMASA-2016-29 - PMASA-2016-56) (deprecated)
According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.17, 4.4.x prior to 4.4.15.8, or 4.6.x prior to 4.6.4. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists d...
phpMyAdmin directory traversal vulnerability (CNVD-2016-11438)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. phpMyAdmin has a directory traversal vulnerability...
Fedora 25 : phpMyAdmin (2016-49e1e93a66)
phpMyAdmin 4.6.4 2016-08-16 ============================= This release includes many security fixes of various levels of severity. Upstream recommends all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are unable t...
phpMyAdmin Information Disclosure Vulnerability (CNVD-2016-10818)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. An information disclosure vulnerability exists in...
phpMyAdmin security bypass vulnerability (CNVD-2016-10814)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A security bypass vulnerability exists in phpMyAdmin...
phpMyAdmin Local Information Disclosure Vulnerability (CNVD-2016-10817)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A local information disclosure vulnerability exists ...
phpMyAdmin Local Information Disclosure Vulnerability (CNVD-2016-10815)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A local information disclosure vulnerability exists ...
phpMyAdmin PHP Code Injection Vulnerability
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A PHP code path vulnerability exists in phpMyAdmin. ...
phpMyAdmin SQL Injection Vulnerability (CNVD-2016-10819)
phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. The tool is capable of creating and deleting databases, creating, deleting, and modifying database tables, executing SQL script commands, and more. A SQL injection vulnerability exists in phpMyAdmin...
