Debian Phpmyadmin vulnerabilities

CVE-2006-1678 [MEDIUM] CVE-2006-1678: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.8.0.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors in unspecified scripts in the themes directory. Scope: local bookworm: resolved (fixed in 4:2.8.0.3-1) bullseye: resolved (fixed in 4:2.8.0.3-1) forky: resolved (fixed in 4:2.8.0.3-1) sid: resolved (fix

CVE-2004-1055 [MEDIUM] CVE-2004-1055: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and ... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser. Scope: local bookworm: resolved (fixed i

CVE-2010-3263 [MEDIUM] CVE-2010-3263: phpmyadmin - Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the se... Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name. Scope: local bookworm: resolved (fixed in 4:3.3.7-1) bullseye: resolved (fixed in 4:3.3.7-1) forky: resolved (fixed in 4:3.3.7-1) sid: resolved (fixed in 4:3.3.7

CVE-2011-4780 [MEDIUM] CVE-2011-4780: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.... Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections. Scope: local bookworm: resolved (fixed in 4:3.4.9-1) bullseye: resol

CVE-2011-1940 [MEDIUM] CVE-2011-1940: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php. Scope: local bookworm: resolved (fixed i

CVE-2006-2417 [LOW] CVE-2006-2417: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 al... Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.0.x before 2.8.0.4 allows remote attackers to inject arbitrary web script or HTML via the theme parameter in unknown scripts. NOTE: the lang parameter is already covered by CVE-2006-2031. Scope: local bookworm: resolved (fixed in 4:2.8.1-1) bullseye: resolved (fixed in 4:2.8.1-1) forky: resolved (fixed in 4:

CVE-2008-1567 [MEDIUM] CVE-2008-1567: phpmyadmin - phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and t... phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information. Scope: local bookworm: resolved (fixed in 2.11.5.1) bullseye: resolved (fixed in 2.11.5.1) forky: resolved (fixed in 2.11.5.1) sid: resolved (fixed in 2.11.

CVE-2010-2958 [MEDIUM] CVE-2010-2958: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAd... Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056. Scope: local bookworm: resolved (fixed in 4:3.3.6-1) bullseye: resolved

CVE-2008-4326 [MEDIUM] CVE-2008-4326: phpmyadmin - The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin bef... The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence. Scope: local bookworm: resolved (fixed in 4:2.11.8.1-3) bullseye: resolved (fixed in 4:

CVE-2007-0341 [MEDIUM] CVE-2007-0341: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when M... Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a CSS style in the convcharset parameter to the top-level URI, a different vulnerability than CVE-2005-0992. Scope: local bookworm: resolved (fixed in 4:2.9.1.

CVE-2013-4999 [MEDIUM] CVE-2013-4999: phpmyadmin - phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive info... phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0.4.2-1) sid:

CVE-2013-4997 [MEDIUM] CVE-2013-4997: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in

CVE-2005-0653 [MEDIUM] CVE-2005-0653: phpmyadmin - phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscor... phpMyAdmin 2.6.1 does not properly grant permissions on tables with an underscore in the name, which grants remote authenticated users more privileges than intended. Scope: local bookworm: resolved (fixed in 3:2.6.1-pl3-1) bullseye: resolved (fixed in 3:2.6.1-pl3-1) forky: resolved (fixed in 3:2.6.1-pl3-1) sid: resolved (fixed in 3:2.6.1-pl3-1) trixie: resolved (

CVE-2011-4782 [MEDIUM] CVE-2011-4782: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.ph... Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter. Scope: local bookworm: resolved (fixed in 4:3.4.9-1) bullseye: resolved (fixed in 4:3.4.9-1) forky: resolved (fixed in 4:3.4.9-1) sid: resol

CVE-2005-3787 [MEDIUM] CVE-2005-3787: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-p... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.6.4-pl4 allow remote attackers to inject arbitrary web script or HTML via (1) the cookie-based login panel, (2) the title parameter and (3) the table creation dialog. Scope: local bookworm: resolved (fixed in 4:2.6.4-pl4-1) bullseye: resolved (fixed in 4:2.6.4-pl4-1) forky: resolved (fixed

CVE-2014-4986 [LOW] CVE-2014-4986: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyA... Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message. Scope: local b

CVE-2014-8326 [LOW] CVE-2014-8326: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the libraries/DatabaseInterface.class.php code for SQL debug output and the js/server_status_mon

CVE-2005-0459 [MEDIUM] CVE-2005-0459: phpmyadmin - phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to ... phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message. Scope: local bookworm: resolved (fixed in 4:2.6.2) bullseye: resolved (fixed in 4:2.6.2) forky: resolved (fixed in 4:2.6.2) sid: resolved (fixed in 4:2.6

CVE-2011-1941 [MEDIUM] CVE-2011-1941: phpmyadmin - Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before... Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Scope: local bookworm: resolved (fixed in 4:3.4.1-1) bullseye: resolved (fixed in 4:3.4.1-1) forky: resolved (fixed in 4:3.4.1-1) sid: resolved (fixed in 4:3.4

CVE-2007-5977 [MEDIUM] CVE-2007-5977: phpmyadmin - Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2... Cross-site scripting (XSS) vulnerability in db_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges to inject arbitrary web script or HTML via a hex-encoded IMG element in the db parameter in a POST request, a different vulnerability than CVE-2006-6942. Scope: local bookworm: resolved (fixed in 4:2.11.2.1-1) b