Mageia: Security Advisory (MGASA-2016-0051)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0051 Updated phpmyadmin/phpseclib packages fix security vulnerability

Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers CVE-2016-1927. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full pa...

Updated phpmyadmin/phpseclib packages fix security vulnerability

Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers CVE-2016-1927. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full pa...

PT-2016-4982

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.12 phpMyAdmin versions 4.4.x through 4.4.15.2 phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote attackers to bypass intended access restrictions by measuring time differences,...

[SECURITY] Fedora 23 Update: phpMyAdmin-4.5.4.1-1.fc23

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

phpMyAdmin Information Disclosure Vulnerability

phpMyAdmin is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SECURITY] Fedora 22 Update: phpMyAdmin-4.5.4-1.fc22

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

Debian DLA-406-1 : phpmyadmin security update

Several flaws were discovered in the CSRF authentication code of phpMyAdmin. CVE-2016-2039 The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values. CVE-2016-2041 The comparison of the XSRF/CSRF token parameter with the value saved ...

[SECURITY] [DLA 406-1] phpmyadmin security update

Package : phpmyadmin Version : 4:3.3.7-11 CVE ID : CVE-2016-2039 CVE-2016-2041 Several flaws were discovered in the CSRF authentication code of phpMyAdmin. CVE-2016-2039 The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values...

phpMyAdmin Directory Traversal Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A directory traversal vulnerability exists in phpMyAdmin due to the program failing to properly invoke scripts, allowing remote attackers to exploit the vulnerability by submitting a special directory...

phpMyAdmin cross-site scripting vulnerability (CNVD-2016-00797)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A cross-site scripting vulnerability exists in phpMyAdmin, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

phpMyAdmin SQL Editor Cross Site Scripting Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A cross-site scripting vulnerability exists in the phpMyAdmin SQL parser, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain...

phpMyAdmin Security Restriction Bypass Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability exists in phpMyAdmin due to a failure of the program to properly generate XSRF/CSRF tokens, which allows remote attackers to exploit the vulnerability by submitting special...

phpMyAdmin Password Guessing Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability exists in phpMyAdmin where the phpMyAdmin 'Math.random' function fails to provide encrypted random numbers, allowing remote attackers to exploit the vulnerability to guess...

DLA-406-1 phpmyadmin - security update

Bulletin has no description...

phpMyAdmin SQL Parsing Directory Traversal Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A directory traversal vulnerability in the phpMyAdmin SQL parser allows attackers to obtain a PHP error message containing the full path by calling a specially crafted script...

FreeBSD : phpmyadmin -- XSS vulnerability in normalization page (7694927f-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : With a crafted table name it is possible to trigger an XSS attack in the database normalization page. We consider this vulnerability to be non-critical. This vulnerability can be triggered only by someone who is logged in to phpMyAdmin, as the usual token...

FreeBSD : phpmyadmin -- Multiple XSS vulnerabilities (6cc06eec-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : - With a crafted table name it is possible to trigger an XSS attack in the database search page. - With a crafted SET value or a crafted search query, it is possible to trigger an XSS attacks in the zoom search page. - With a crafted hostname header, it i...

FreeBSD : phpmyadmin -- Unsafe comparison of XSRF/CSRF token (71b24d99-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern. We consider this vulnerability to be...

FreeBSD : phpmyadmin -- Full path disclosure vulnerability in SQL parser (78b4ebfb-c60b-11e5-bf36-6805ca0b3d42)

The phpMyAdmin development team reports : By calling a particular script that is part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. We consider this vulnerability...