Debian Phpmyadmin vulnerabilities

CVE-2013-5002 [LOW] CVE-2013-5002: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Sch... Cross-site scripting (XSS) vulnerability in libraries/schema/Export_Relation_Schema.class.php in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1) bullseye: resolved (fixed in 4:4.

CVE-2013-5001 [LOW] CVE-2013-5001: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/ab... Cross-site scripting (XSS) vulnerability in libraries/plugins/transformations/abstract/TextLinkTransformationsPlugin.class.php in phpMyAdmin 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted object name associated with a TextLinkTransformationPlugin link. Scope: local bookworm: resolved (fixed in 4:4.0.4.2-1)

CVE-2012-4579 [LOW] CVE-2012-4579: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for

CVE-2012-4219 [MEDIUM] CVE-2012-4219: phpmyadmin - show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attacker... show_config_errors.php in phpMyAdmin 3.5.x before 3.5.2.1 allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message, related to lack of inclusion of the common.inc.php library file. Scope: local bookworm: resolved (fixed in 4:4.0.1-1) bullseye: resolved (fixed in 4:4.0.1-1) forky: resolve

CVE-2012-1902 [MEDIUM] CVE-2012-1902: phpmyadmin - show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration... show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file. Scope: local bookworm: resolved (fixed in 4:3.4.10.2-1) bullseye: resolved (fixed in 4:3.4.10.2-1) forky

CVE-2008-3457 [LOW] CVE-2008-3457: phpmyadmin - Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.... Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments. NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php. Scope: local bookworm: resolved (fixed in 4:2.11.8~r

CVE-2008-2960 [LOW] CVE-2008-2960: phpmyadmin - Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when regis... Cross-site scripting (XSS) vulnerability in phpMyAdmin before 2.11.7, when register_globals is enabled and .htaccess support is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving scripts in libraries/. Scope: local bookworm: resolved (fixed in 4:2.11.7~rc2-1) bullseye: resolved (fixed in 4:2.11.7~rc2-1) forky:

CVE-2011-3646 [MEDIUM] CVE-2011-3646: phpmyadmin - phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to o... phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message. Scope: local bookworm: resolved (fixed in 4:3.4.6-1) bullseye: resolved (fixed in 4:3.4.6-1) forky: resolved (fixed in 4:3.4.6-1) sid: reso

CVE-2006-2031 [LOW] CVE-2006-2031: phpmyadmin - Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8... Cross-site scripting (XSS) vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Scope: local bookworm: resolved (fixed in 4:2.8.1-1) bullseye: resolved (fixed in 4:2.8.1-1) forky: resolved (fixed in 4:2.8.1-1) sid: resolved (fixed in 4:2.8.1-1) trixi

CVE-2007-6100 [MEDIUM] CVE-2007-6100: phpmyadmin - Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php i... Cross-site scripting (XSS) vulnerability in libraries/auth/cookie.auth.lib.php in phpMyAdmin before 2.11.2.2, when logins are authenticated with the cookie auth_type, allows remote attackers to inject arbitrary web script or HTML via the convcharset parameter to index.php, a different vulnerability than CVE-2005-0992. Scope: local bookworm: resolved (fixed in 4:2

CVE-2011-2642 [LOW] CVE-2011-2642: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in the table Print view impl... Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name. Scope: local bookworm: resolved (fixed in 4:3.4.3.2-1) bullseye: resolved (fixed in 4:3.4.3.2-1) forky:

CVE-2007-0095 [MEDIUM] CVE-2007-0095: phpmyadmin - phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a... phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message. Scope: local bookworm: resolved (fixed in 4:2.9.1.1-1) bullseye: resolved (fixed in 4:2.9.1.1-1) forky: resolved (fixed in 4:2.9.1.1-1) sid: resolved (fixed in 4:2.9.1.1-1) trixie: r

CVE-2006-6373 [MEDIUM] CVE-2006-6373: phpmyadmin - PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via... PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message. Scope: local bookworm: resolved (fixed in 4:2.9.1.1-1) bullseye: resolved (fixed in 4:2.9.1.1-1) forky: resolved (fixed in 4:2.9.1.1-1) sid: resolved (fixed in 4:2.9.1.1-1) trixie: resolved (fi