Debian Phpmyadmin vulnerabilities

CVE-2013-5000 [MEDIUM] CVE-2013-5000: phpmyadmin - phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive info... phpMyAdmin 3.5.x before 3.5.8.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message, related to config.default.php and other files. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.0.4.2-1) forky: resolved (fixed in 4:4.0.4.2-1) sid: resolved

CVE-2012-1902 [MEDIUM] CVE-2012-1902: phpmyadmin - show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration... show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file. Scope: local bookworm: resolved (fixed in 4:3.4.10.2-1) bullseye: resolved (fixed in 4:3.4.10.2-1) forky

CVE-2013-3742 [LOW] CVE-2013-3742: phpmyadmin - Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View... Cross-site scripting (XSS) vulnerability in view_create.php (aka the Create View page) in phpMyAdmin 4.x before 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via an invalid SQL CREATE VIEW statement with a crafted name that triggers an error message. Scope: local bookworm: resolved (fixed in 4:4.0.1-3) bullseye: resolved (fixed in 4:

CVE-2013-5002 [LOW] CVE-2013-5002: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Sch... Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.

CVE-2013-5001 [LOW] CVE-2013-5001: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/ab... Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1)

CVE-2008-3457 [LOW] CVE-2008-3457: phpmyadmin - Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.... Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php. Scope: local bookworm: resolved (fixed in 4:2.11.8~r

CVE-2008-2960 [LOW] CVE-2008-2960: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when regis... Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/. Scope: local bookworm: resolved (fixed in 4:2.11.7~rc2-1) bullseye: resolved (fixed in 4:2.11.7~rc2-1) forky:

CVE-2011-3646 [MEDIUM] CVE-2011-3646: phpmyadmin - phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to o... phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message. Scope: local bookworm: resolved (fixed in 4:3.4.6-1) bullseye: resolved (fixed in 4:3.4.6-1) forky: resolved (fixed in 4:3.4.6-1) sid: reso

CVE-2006-2031 [LOW] CVE-2006-2031: phpmyadmin - Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8... Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Scope: local bookworm: resolved (fixed in 4:2.8.1-1) bullseye: resolved (fixed in 4:2.8.1-1) forky: resolved (fixed in 4:2.8.1-1) sid: resolved (fixed in 4:2.8.1-1) trixi

CVE-2007-6100 [MEDIUM] CVE-2007-6100: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php i... Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992. Scope: local bookworm: resolved (fixed in 4:2

CVE-2011-2642 [LOW] CVE-2011-2642: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the table Print view impl... Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name. Scope: local bookworm: resolved (fixed in 4:3.4.3.2-1) bullseye: resolved (fixed in 4:3.4.3.2-1) forky:

CVE-2007-0095 [MEDIUM] CVE-2007-0095: phpmyadmin - phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a... phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message. Scope: local bookworm: resolved (fixed in 4:2.9.1.1-1) bullseye: resolved (fixed in 4:2.9.1.1-1) forky: resolved (fixed in 4:2.9.1.1-1) sid: resolved (fixed in 4:2.9.1.1-1) trixie: r

CVE-2006-6373 [MEDIUM] CVE-2006-6373: phpmyadmin - PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via... PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message. Scope: local bookworm: resolved (fixed in 4:2.9.1.1-1) bullseye: resolved (fixed in 4:2.9.1.1-1) forky: resolved (fixed in 4:2.9.1.1-1) sid: resolved (fixed in 4:2.9.1.1-1) trixie: resolved (fi