Debian Phpmyadmin vulnerabilities

CVE-2014-5273 [LOW] CVE-2014-5273: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) browse table page, related to js/sql.js; (2) ENUM editor page, related to js/functions.js; (3) monitor page, related to js/server_status_monitor.js

CVE-2014-8960 [LOW] CVE-2014-8960: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in th... Cross-site scripting (XSS) vulnerability in libraries/error_report.lib.php in the error-reporting feature in phpMyAdmin 4.1.x before 4.1.14.7 and 4.2.x before 4.2.12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. Scope: local bookworm: resolved (fixed in 4:4.2.12-1) bullseye: resolved (fixed in 4:4.2.12-1) forky: res

CVE-2014-4348 [LOW] CVE-2014-4348: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name that is improperly handled after presence in (a) the favorite list or (b) recent tables. Scope: local bookworm: resolved (fixed in 4:4.2.5-1) bullseye: resolved

CVE-2013-4998 [MEDIUM] CVE-2013-4998: phpmyadmin - phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers... phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to pmd_common.php and other files. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0

CVE-2006-5718 [MEDIUM] CVE-2006-5718: phpmyadmin - Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 throug... Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data. Scope: local bookworm: resolved (fixed in

CVE-2007-1395 [MEDIUM] CVE-2007-1395: phpmyadmin - Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.... Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by injecting arbitrary JavaScript or HTML in a (1) db or (2) table parameter value followed by an uppercase end tag, which bypasses the protection against lowercase . Scope: local bookworm: resolved (fixed in 4:2.

CVE-2007-2016 [MEDIUM] CVE-2007-2016: phpmyadmin - Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.... Cross-site scripting (XSS) vulnerability in mysql/phpinfo.php in phpMyAdmin 2.6.1 allows remote attackers to inject arbitrary web script or HTML via the lang[] parameter. Scope: local bookworm: resolved (fixed in 4:2.6.2-3) bullseye: resolved (fixed in 4:2.6.2-3) forky: resolved (fixed in 4:2.6.2-3) sid: resolved (fixed in 4:2.6.2-3) trixie: resolved (fixed in 4:

CVE-2014-4349 [LOW] CVE-2014-4349: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a (1) hide or (2) unhide action. Scope: local bookworm: resolved (fixed in 4:4.2.5-1) bullseye: resolved (fixed in 4:4.2.5-1) f

CVE-2014-7217 [LOW] CVE-2014-7217: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to libraries/TableSearch.clas

CVE-2014-4955 [LOW] CVE-2014-4955: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function i... Cross-site scripting (XSS) vulnerability in the PMA_TRI_getRowForList function in libraries/rte/rte_list.lib.php in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted trigger name that is improperly handled on the database triggers page. Scope: local b

CVE-2014-4954 [LOW] CVE-2014-4954: phpmyadmin - Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks functi... Cross-site scripting (XSS) vulnerability in the PMA_getHtmlForActionLinks function in libraries/structure.lib.php in phpMyAdmin 4.2.x before 4.2.6 allows remote authenticated users to inject arbitrary web script or HTML via a crafted table comment that is improperly handled during construction of a database structure page. Scope: local bookworm: resolved (fixed in 4

CVE-2013-4995 [LOW] CVE-2013-4995: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and ... Cross-site scripting (XSS) vulnerability in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SQL query that is not properly handled during the display of row information. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky

CVE-2012-4345 [LOW] CVE-2012-4345: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure pa... Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name. Scope: local bookworm: resolved (fixe

CVE-2011-3592 [LOW] CVE-2011-3592: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow f... Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation. Scope: local bookworm: resolved (fixed

CVE-2011-3591 [LOW] CVE-2011-3591: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js. Scope: local bookworm: resolve

CVE-2013-5000 [MEDIUM] CVE-2013-5000: phpmyadmin - phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive info... phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0.4.2-1) sid: resolved

CVE-2013-3742 [LOW] CVE-2013-3742: phpmyadmin - Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View... Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message. Scope: local bookworm: resolved (fixed in 4:4.0.1-3) bullseye: resolved (fixed in 4:

CVE-2014-5274 [LOW] CVE-2014-5274: phpmyadmin - Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdm... Cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to js/functions.js. Scope: local bookworm: resolved (fixed in 4:4.2.7.1-1) bullseye: resolved (fixed in 4:4.2.7.1-1) forky: resolved

CVE-2008-3197 [LOW] CVE-2008-3197: phpmyadmin - Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 al... Cross-site request forgery (CSRF) vulnerability in phpMyAdmin before 2.11.7.1 allows remote attackers to perform unauthorized actions via a link or IMG tag to (1) the db parameter in the "Creating a Database" functionality (db_create.php), and (2) the convcharset and collation_connection parameters related to an unspecified program that modifies the connection chara

CVE-2014-1879 [LOW] CVE-2014-1879: phpmyadmin - Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.... Cross-site scripting (XSS) vulnerability in import.php in phpMyAdmin before 4.1.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename in an import action. Scope: local bookworm: resolved (fixed in 4:4.1.7-1) bullseye: resolved (fixed in 4:4.1.7-1) forky: resolved (fixed in 4:4.1.7-1) sid: resolved (fixed in 4:4.1.7-1) trix