p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de phpmyadmin/phpmyadmin · Página 4

Vulnerabilidades publicadas para phpmyadmin/phpmyadmin en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 107

  1. CVE-2016-5733

    Media · CVSS 6.1EPSS 2,18%Corrección disponible

    CVE-2016-5733

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a crafted table name that is mishandled during privilege checking in table_row.phtml, (2) a crafted mysqld log_bin directive that is mishandled in log_selector.phtml, (3) the Transformation implementation, (4) AJAX error handling in js/ajax.js, (5) the Designer implementation, (6) the charts implementation in js/tbl_chart.js, or (7) the zoom-search implementation in rows_zoom.phtml.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.16
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2016-5732

    Media · CVSS 6.1EPSS 1,64%Corrección disponible

    CVE-2016-5732

    Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in templates/table/structure/display_partitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.

    phpmyadmin/phpmyadminPHP
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2016-5731

    Media · CVSS 6.1EPSS 1,75%Corrección disponible

    CVE-2016-5731

    Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.16
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2016-5730

    Media · CVSS 5.3EPSS 2,62%Corrección disponible

    CVE-2016-5730

    phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.16
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2016-5706

    Alta · CVSS 7.5EPSS 2,81%Corrección disponible

    CVE-2016-5706

    js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.16
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2016-5705

    Media · CVSS 6.1EPSS 1,31%Corrección disponible

    CVE-2016-5705

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) server-privileges certificate data fields on the user privileges page, (2) an "invalid JSON" error message in the error console, (3) a database name in the central columns implementation, (4) a group name, or (5) a search name in the bookmarks implementation.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2016-5701

    Media · CVSS 6.1EPSS 1,54%Corrección disponible

    CVE-2016-5701

    setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16, 4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.16
    • Actualiza a 4.4.15.7
    • Actualiza a 4.6.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2016-2562

    Media · CVSS 6.8EPSS 0,78%Corrección disponible

    CVE-2016-2562

    The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.

    phpmyadmin/phpmyadminPHP
    • Actualiza a 4.5.5.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2016-2559

    Media · CVSS 5.4EPSS 1,71%Corrección disponible

    CVE-2016-2559

    Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

    phpmyadmin/phpmyadminPHP
    • Actualiza a 4.5.5.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2016-2041

    Alta · CVSS 7.5EPSS 2,58%Corrección disponible

    CVE-2016-2041

    libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.13
    • Actualiza a 4.4.15.3
    • Actualiza a 4.5.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2016-2040

    Media · CVSS 5.4EPSS 1,64%Corrección disponible

    CVE-2016-2040

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.13
    • Actualiza a 4.4.15.3
    • Actualiza a 4.5.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2016-1927

    Alta · CVSS 7.5EPSS 2,69%Corrección disponible

    CVE-2016-1927

    The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.13
    • Actualiza a 4.4.15.3
    • Actualiza a 4.5.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2015-6830

    Sin evaluarEPSS 10,43%Código de explotación públicoCorrección disponible

    CVE-2015-6830

    libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.3.13.2
    • Actualiza a 4.4.14.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2011-3592

    Sin evaluarEPSS 1,45%Corrección disponible

    CVE-2011-3592

    Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.

    phpmyadmin/phpmyadminPHP
    • Actualiza a 3.4.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2011-3591

    Sin evaluarEPSS 1,45%Corrección disponible

    CVE-2011-3591

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.

    phpmyadmin/phpmyadminPHP
    • Actualiza a 3.4.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2014-6300

    Sin evaluarEPSS 1,86%Corrección disponible

    CVE-2014-6300

    Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.3
    • Actualiza a 4.1.14.4
    • Actualiza a 4.2.8.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2014-8326

    Sin evaluarEPSS 1,53%Corrección disponible

    CVE-2014-8326

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_monitor.js code for the server monitor page.

    phpmyadmin/phpmyadmin phpmyadmin/phpmyadmin phpmyadmin/phpmyadminPHP
    • Actualiza a 4.0.10.5
    • Actualiza a 4.1.14.6
    • Actualiza a 4.2.10.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →