CVE-2016-2044

CVE-2016-2044 affects phpMyAdmin 4.5.x before 4.5.4. The information disclosure occurs in libraries/sql-parser/autoload.php of the SQL parser, where a crafted request causes an error message that reveals the full installation path to an unauthenticated/remote attacker. The vulnerability is a resu...

CVE-2016-2040

CVE-2016-2040 is an XSS vulnerability in phpMyAdmin affecting multiple branches (4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, 4.5.x before 4.5.4) where remote authenticated users can inject arbitrary script via a Location header, as well as via table name, SET value, or search query. Connected ...

PT-2016-4984

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.2 phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page. This is due to a...

CVE-2016-2038: Exposure of Sensitive Information to an Unauthorized Actor

phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2039: Exposure of Sensitive Information to an Unauthorized Actor

libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value...

CVE-2016-2041: Undefined Security Weakness

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences...

PT-2016-4985

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote attackers to obtain sensitive information via a crafted request. This is achieved by exploiting the SQL parser in phpMyAdmin, which reveals the full path in an error...

CVE-2016-2044: Exposure of Sensitive Information to an Unauthorized Actor

libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message...

CVE-2016-2042: Exposure of Sensitive Information to an Unauthorized Actor

phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2 libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message...

CVE-2016-2040: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

CVE-2016-1927: Undefined Security Weakness

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...

CVE-2016-2043: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page...

PT-2016-4986

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.5.x prior to 4.5.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response, due to a cross-site scripting XSS vulnerability in t...

CVE-2016-2045: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response...

PT-2016-4983

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.4.x through 4.4.15.2 phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote attackers to obtain sensitive information through a crafted request to 1 libraries/phpseclib/Crypt/AES.php or 2...

openSUSE Security Update : phpMyAdmin 4.4.15.4 (openSUSE-2016-168)

Security update to phpMyAdmin 4.4.15.4 The followinng vulnerabilities were fixed: boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password...

phpMyAdmin security bypass vulnerability (CNVD-2016-00893)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability exists in phpMyAdmin that allows remote attackers to exploit a vulnerability to submit special requests to bypass XSRF/CSRF token parameter restrictions...

phpMyAdmin cross-site scripting vulnerability (CNVD-2016-00891)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A cross-site scripting vulnerability exists in phpMyAdmin, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

phpMyAdmin Information Disclosure Vulnerability (CNVD-2016-00892)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability exists in phpMyAdmin that allows remote attackers to exploit the vulnerability to submit special requests to obtain sensitive information...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-151)

This update to phpMyAdmin 4.4.15.4 fixes the following issues boo964024 - CVE-2016-2038: Multiple full path disclosure vulnerabilities - CVE-2016-2039: Unsafe generation of XSRF/CSRF token - CVE-2016-2040: Multiple XSS vulnerabilities - CVE-2016-1927: Insecure password generation in JavaScript -...