Remote code execution vulnerability when PHP is running with dbase extension

PMASA-2016-56 Announcement-ID: PMASA-2016-56 Date: 2016-07-25 Summary Remote code execution vulnerability when PHP is running with dbase extension Description A vulnerability was discovered where phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations...

Debian DSA-3627-1 : phpmyadmin - security update

Several vulnerabilities have been fixed in phpMyAdmin, the web-based MySQL administration interface. - CVE-2016-1927 The suggestPassword function relied on a non-secure random number generator which makes it easier for remote attackers to guess generated passwords via a brute-force approach. -...

[SECURITY] [DSA 3627-1] phpmyadmin security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3627-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst July 24, 2016 https://www.debian.org/security/faq -...

Bypass URL redirect protection

PMASA-2016-49 Announcement-ID: PMASA-2016-49 Date: 2016-07-24 Summary Bypass URL redirect protection Description A vulnerability was discovered where an attacker could redirect a user to a malicious web page. Severity We consider this to be of moderate severity Affected Versions All 4.6.x version...

Referrer leak in url.php

PMASA-2016-50 Announcement-ID: PMASA-2016-50 Date: 2016-07-24 Summary Referrer leak in url.php Description A vulnerability was discovered where an attacker can determine the phpMyAdmin host location through the file url.php. Severity We consider this to be of moderate severity. Affected Versions...

DSA-3627-1 phpmyadmin - security update

Bulletin has no description...

Reflected File Download attack

PMASA-2016-51 Announcement-ID: PMASA-2016-51 Date: 2016-07-24 Summary Reflected File Download attack Description A vulnerability was discovered where an attacker may be able to trigger a user to download a specially crafted malicious SVG file. Severity We consider this issue to be of moderate...

Detect if user is logged in

PMASA-2016-48 Announcement-ID: PMASA-2016-48 Date: 2016-07-24 Summary Detect if user is logged in Description A vulnerability was reported where an attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerabilit...

IPv6 and proxy server IP-based authentication rule circumvention

PMASA-2016-47 Announcement-ID: PMASA-2016-47 Date: 2016-07-21 Summary IPv6 and proxy server IP-based authentication rule circumvention Description A vulnerability was discovered where, under certain circumstances, it may be possible to circumvent the phpMyAdmin IP-based authentication rules. When...

DOS attack with forced persistent connections

PMASA-2016-45 Announcement-ID: PMASA-2016-45 Date: 2016-07-21 Summary DOS attack with forced persistent connections Description A vulnerability was discovered where an unauthenticated user is able to execute a denial-of-service DOS attack by forcing persistent connections when phpMyAdmin is runni...

phpMyAdmin 4.0.10.x < 4.0.10.16 / 4.4.15.x < 4.4.15.7 / 4.6.x < 4.6.3 Multiple Vulnerabilities

Binary data 9400.prm...

Debian DLA-551-1 : phpmyadmin security update

Phpmyadmin, a web administration tool for MySQL, had several Cross Site Scripting XSS vulnerabilities were reported. CVE-2016-5731 With a specially crafted request, it is possible to trigger an XSS attack through the example OpenID authentication script. CVE-2016-5733 Several XSS vulnerabilities...

[SECURITY] [DLA 551-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.4.11.1-2+deb7u5 CVE ID : CVE-2016-5731 CVE-2016-5733 CVE-2016-5739 Phpmyadmin, a web administration tool for MySQL, had several Cross Site Scripting XSS vulnerabilities were reported. CVE-2016-5731 With a specially crafted request, it is possible to trigger an X...

DLA-551-1 phpmyadmin - security update

Bulletin has no description...

Fedora 23 : phpMyAdmin (2016-9df3915036)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...

Fedora 22 : phpMyAdmin (2016-56ee5cb8b6)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...

Fedora 24 : phpMyAdmin (2016-81c2dabf20)

phpMyAdmin 4.6.3 2016-06-23 ============================= This version includes many security fixes that are announced as PMASA-2016-17 through PMASA-2016-28 which are posted at https://www.phpmyadmin.net/security/ Furthermore, version 4.6.3 includes the regularly scheduled maintenance improvemen...

SQL injection attack as control user

PMASA-2016-42 Announcement-ID: PMASA-2016-42 Date: 2016-07-15 Summary SQL injection attack as control user Description A vulnerability was discovered in the user interface preference feature where a user can execute an SQL injection attack against the account of the control user. Severity We...

SQL injection attack

PMASA-2016-39 Announcement-ID: PMASA-2016-39 Date: 2016-07-14 Summary SQL injection attack Description A vulnerability was discovered in the following features where a user can execute an SQL injection attack against the account of the control user: User group Designer Severity We consider this...

SQL injection attack

PMASA-2016-40 Announcement-ID: PMASA-2016-40 Date: 2016-07-14 Summary SQL injection attack Description A vulnerability was reported where a specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. Severity We consider this...