Debian Phpmyadmin vulnerabilities

CVE-2014-5273 [LOW] CVE-2014-5273: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js

CVE-2014-7217 [LOW] CVE-2014-7217: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.clas

CVE-2014-4348 [LOW] CVE-2014-4348: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables. Scope: local bookworm: resolved (fixed in 4:4.2.5-1) bullseye: resolved

CVE-2014-4955 [LOW] CVE-2014-4955: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function i... Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page. Scope: local b

CVE-2014-4954 [LOW] CVE-2014-4954: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks functi... Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page. Scope: local bookworm: resolved (fixed in 4

CVE-2011-3592 [LOW] CVE-2011-3592: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow f... Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation. Scope: local bookworm: resolved (fixed

CVE-2013-4999 [MEDIUM] CVE-2013-4999: phpmyadmin - phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive info... phpMyAdmin 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to Error.class.php and Error_Handler.class.php. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0.4.2-1) sid:

CVE-2005-0459 [MEDIUM] CVE-2005-0459: phpmyadmin - phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to ... phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message. Scope: local bookworm: resolved (fixed in 4:2.6.2) bullseye: resolved (fixed in 4:2.6.2) forky: resolved (fixed in 4:2.6.2) sid: resolved (fixed in 4:2.6

CVE-2011-1941 [MEDIUM] CVE-2011-1941: phpmyadmin - Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before... Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Scope: local bookworm: resolved (fixed in 4:3.4.1-1) bullseye: resolved (fixed in 4:3.4.1-1) forky: resolved (fixed in 4:3.4.1-1) sid: resolved (fixed in 4:3.4

CVE-2007-1395 [MEDIUM] CVE-2007-1395: phpmyadmin - Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.... Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase end tag, which bypasses the protection against lowercase . Scope: local bookworm: resolved (fixed in 4:2.

CVE-2007-2016 [MEDIUM] CVE-2007-2016: phpmyadmin - Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.... Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter. Scope: local bookworm: resolved (fixed in 4:2.6.2-3) bullseye: resolved (fixed in 4:2.6.2-3) forky: resolved (fixed in 4:2.6.2-3) sid: resolved (fixed in 4:2.6.2-3) trixie: resolved (fixed in 4:

CVE-2013-4995 [LOW] CVE-2013-4995: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and ... Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky

CVE-2012-4345 [LOW] CVE-2012-4345: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure pa... Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name. Scope: local bookworm: resolved (fixe

CVE-2011-3591 [LOW] CVE-2011-3591: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js. Scope: local bookworm: resolve

CVE-2013-4998 [MEDIUM] CVE-2013-4998: phpmyadmin - phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers... phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0

CVE-2014-5274 [LOW] CVE-2014-5274: phpmyadmin - Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdm... Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js. Scope: local bookworm: resolved (fixed in 4:4.2.7.1-1) bullseye: resolved (fixed in 4:4.2.7.1-1) forky: resolved

CVE-2008-3197 [LOW] CVE-2008-3197: phpmyadmin - Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 al... Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection chara

CVE-2014-1879 [LOW] CVE-2014-1879: phpmyadmin - Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.... Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. Scope: local bookworm: resolved (fixed in 4:4.1.7-1) bullseye: resolved (fixed in 4:4.1.7-1) forky: resolved (fixed in 4:4.1.7-1) sid: resolved (fixed in 4:4.1.7-1) trix

CVE-2012-4579 [LOW] CVE-2012-4579: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for

CVE-2012-4219 [MEDIUM] CVE-2012-4219: phpmyadmin - show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attacker... show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file. Scope: local bookworm: resolved (fixed in 4:4.0.1-1) bullseye: resolved (fixed in 4:4.0.1-1) forky: resolve