UBUNTU-CVE-2016-9857

An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-6618

An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service DoS attack against the server. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6628

An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-9849

An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction $cfg'Servers'$i'AllowRoot' and deny rules for username by using Null Byte in the username. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-9848

CVE-2016-9848 affects phpMyAdmin: the phpinfo() output reveals PHP info including the values of HttpOnly cookies. Affected versions are all 4.6.x before 4.6.5, all 4.4.x before 4.4.15.9, and all 4.0.x before 4.0.10.18. The issue is due to exposure of cookie values in phpinfo output. Mitigation: u...

CVE-2016-9858

An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are affected...

CVE-2016-9856

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...

CVE-2016-6611

An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6619

An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-9862

An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions prior to 4.6.5 are affected...

CVE-2016-6630

CVE-2016-6630 describes a DoS in phpMyAdmin triggered by an authenticated user who enters a very long password in the Change password dialog. Affected are phpMyAdmin 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Connected documents corroborate the vulnerability in multipl...

CVE-2016-6607

phpMyAdmin is affected by CVE-2016-6607: XSS vulnerabilities in multiple components (Zoom search, GIS editor, relations view, various Transformations, XML/MediaWiki exports, Designer, etc.) due to improper escaping. Affected are phpMyAdmin 4.0.x before 4.0.10.17, 4.4.x before 4.4.15.8, and 4.6.x ...

CVE-2016-6612

CVE-2016-6612 affects phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. Affected are all 4.6.x versions before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. The connected documents confirm this vulnerability and li...

CVE-2016-4412

phpMyAdmin vulnerability CVE-2016-4412: a user can be tricked into following a link that, after authentication, redirects to a malicious site. Affected are all 4.0.x versions before 4.0.10.16; the attacker must sniff the user’s valid phpMyAdmin token. Remediation: upgrade to a patched version (4....

CVE-2016-9863

An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service DoS attack. All 4.6.x versions prior to 4.6.5 are affected...

CVE-2016-6613

CVE-2016-6613 affects phpMyAdmin. A user can craft a symlink on disk to a file that phpMyAdmin can read but the user cannot, which phpMyAdmin will expose to the user. Affected versions are all 4.6.x before 4.6.4, 4.4.x before 4.4.15.8, and 4.0.x before 4.0.10.17. Remediation is to upgrade to 4.6....

CVE-2016-9853

CVE-2016-9853 affects phpMyAdmin; a fopen wrapper-related issue can cause PHP error messages to disclose the full phpMyAdmin directory path, especially during export timeout. Affected: phpMyAdmin 4.6.x before 4.6.5 and 4.4.x before 4.4.15.9. Remediation: upgrade to a fixed release (Gentoo GLSA re...

CVE-2016-6609

An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

CVE-2016-6629

An issue was discovered in phpMyAdmin involving the $cfg'ArbitraryServerRegexp' configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x...

CVE-2016-6622

phpMyAdmin DoS (CVE-2016-6622): An unauthenticated user can trigger a denial-of-service by forcing persistent connections when phpMyAdmin is configured with $cfg['AllowArbitraryServer']=true. Affected versions: all 4.6.x prior to 4.6.4, 4.4.x prior to 4.4.15.8, and 4.0.x prior to 4.0.10.17. Conne...