CVE-2011-4782
published 2011-12-22CVE-2011-4782: Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote…
PriorityP415medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.30%
67.1th percentile
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | phpmyadmin | < phpmyadmin 4:3.4.9-1 (bookworm) | phpmyadmin 4:3.4.9-1 (bookworm) |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | — | — |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.9-1 | 4:3.4.9-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.9-1 | 4:3.4.9-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.9-1 | 4:3.4.9-1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:3.4.9-1 | 4:3.4.9-1 |
| phpmyadmin | phpmyadmin | >= 3.4.0 < 3.4.9 | 3.4.9 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_redhat5.0MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
phpMyAdmin Cross-site Scripting vulnerability
ghsa·2022-05-17
CVE-2011-4782 [LOW] CWE-79 phpMyAdmin Cross-site Scripting vulnerability
phpMyAdmin Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
OSV
phpMyAdmin Cross-site Scripting vulnerability
osv·2022-05-17
CVE-2011-4782 [LOW] phpMyAdmin Cross-site Scripting vulnerability
phpMyAdmin Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
OSV
CVE-2011-4782: Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile
osv·2011-12-22·CVSS 4.3
CVE-2011-4782 [MEDIUM] CVE-2011-4782: Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Debian
CVE-2011-4782: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.ph...
vendor_debian·2011·CVSS 4.3
CVE-2011-4782 [MEDIUM] CVE-2011-4782: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.ph...
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Scope: local
bookworm: resolved (fixed in 4:3.4.9-1)
bullseye: resolved (fixed in 4:3.4.9-1)
forky: resolved (fixed in 4:3.4.9-1)
sid: resolved (fixed in 4:3.4.9-1)
trixie: resolved (fixed in 4:3.4.9-1)
Red Hat
glibc: fnmatch() alloca()-based memory corruption flaw
vendor_redhat·2010-08-05·CVSS 5.0
CVE-2011-1071 [MEDIUM] glibc: fnmatch() alloca()-based memory corruption flaw
glibc: fnmatch() alloca()-based memory corruption flaw
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.htmlhttp://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cdhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:198http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.phphttps://exchange.xforce.ibmcloud.com/vulnerabilities/71938http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071523.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/071537.htmlhttp://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=0e707906e69ce90c4852a0fce2a0fac7db86a3cdhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:198http://www.phpmyadmin.net/home_page/security/PMASA-2011-19.phphttps://exchange.xforce.ibmcloud.com/vulnerabilities/71938
2011-12-22
Published