CVE-2011-3591
published 2014-12-26CVE-2011-3591: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML…
PriorityP413low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.45%
70.6th percentile
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:3.4.5-1 (bookworm) | phpmyadmin 4:3.4.5-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.5-1 | 4:3.4.5-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.5-1 | 4:3.4.5-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.5-1 | 4:3.4.5-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.5-1 | 4:3.4.5-1 |
| phpmyadmin | phpmyadmin | >= 3.4.0 < 3.4.5 | 3.4.5 |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
ghsa·2022-05-17
CVE-2011-3591 [LOW] CWE-79 phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) `js/functions.js` and (2) `js/tbl_structure.js`.
OSV
phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
osv·2022-05-17
CVE-2011-3591 [LOW] phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
phpMyAdmin Multiple XSS Vulnerabilities After Inline Editing and Save
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) `js/functions.js` and (2) `js/tbl_structure.js`.
OSV
CVE-2011-3591: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3
osv·2014-12-26·CVSS 3.5
CVE-2011-3591 [LOW] CVE-2011-3591: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
Debian
CVE-2011-3591: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3...
vendor_debian·2011·CVSS 3.5
CVE-2011-3591 [LOW] CVE-2011-3591: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3...
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
Scope: local
bookworm: resolved (fixed in 4:3.4.5-1)
bullseye: resolved (fixed in 4:3.4.5-1)
forky: resolved (fixed in 4:3.4.5-1)
sid: resolved (fixed in 4:3.4.5-1)
trixie: resolved (fixed in 4:3.4.5-1)
No detection rules found.
Exploit-DB
Oracle Document Capture - 'empop3.dll' Insecure Methods
exploitdb·2011-01-26·CVSS 9.3
CVE-2010-3591 [CRITICAL] Oracle Document Capture - 'empop3.dll' Insecure Methods
Oracle Document Capture - 'empop3.dll' Insecure Methods
---
Source: http://packetstormsecurity.org/files/view/97868/DSECRG-11-005.txt
ActiveX components contain insecure methods.
Digital Security Research Group [DSecRG] Advisory DSECRG-11-005 (internal #DSECRG-00154)
Application: Oracle Document Capture
Versions Affected: Release 10gR3
Vendor URL: www.oracle.com
Bugs: insecure method, File overwriting, File deleting
Exploits: YES
Reported: 22.03.2010
Vendor response: 31.03.2010
Date of Public Advisory:24.01.2011
CVE-number: CVE-2010-3591
Author: Evdokimov Dmitriy from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
Oracle Document Capture contains ActiveX components that contains insecure methods in empop3.dll
Details
Oracle Document Captu
Exploit-DB
Oracle Document Capture - Actbar2.ocx Insecure Method
exploitdb·2011-01-26·CVSS 9.3
CVE-2010-3591 [CRITICAL] Oracle Document Capture - Actbar2.ocx Insecure Method
Oracle Document Capture - Actbar2.ocx Insecure Method
---
Source: http://packetstormsecurity.org/files/view/97866/DSECRG-11-004.txt
ActiveX components contain insecure methods.
Digital Security Research Group [DSecRG] Advisory #DSECRG-00153
Application: Oracle Document Capture
Versions Affected: Release 10gR3
Vendor URL: www.oracle.com
Bugs: insecure method, File overwriting
Exploits: YES
Reported: 22.03.2010
Vendor response: 31.03.2010
Date of Public Advisory:24.01.2011
CVE-number: CVE-2010-3591
Author: Evdokimov Dmitriy from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)
Description
Oracle Document Capture contains ActiveX components that contains insecure methods.
Insecure method in Actbar2.ocx
Details
Oracle Document Capture contains ActiveX comp
http://www.openwall.com/lists/oss-security/2011/09/30/8http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.phphttps://bugzilla.redhat.com/show_bug.cgi?id=738681https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170http://www.openwall.com/lists/oss-security/2011/09/30/8http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.phphttps://bugzilla.redhat.com/show_bug.cgi?id=738681https://github.com/phpmyadmin/phpmyadmin/commit/bda213c58aec44925be661acb0e76c19483ea170
2014-12-26
Published