Debian Phpmyadmin vulnerabilities

CVE-2005-0459 [MEDIUM] CVE-2005-0459: phpmyadmin - phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to ... phpMyAdmin 2.6.2-dev, and possibly earlier versions, allows remote attackers to determine the full path of the web root via a direct request to select_lang.lib.php, which reveals the path in a PHP error message. Scope: local bookworm: resolved (fixed in 4:2.6.2) bullseye: resolved (fixed in 4:2.6.2) forky: resolved (fixed in 4:2.6.2) sid: resolved (fixed in 4:2.6

CVE-2005-4079 [MEDIUM] CVE-2005-4079: phpmyadmin - The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers t... The register_globals emulation in phpMyAdmin 2.7.0 rc1 allows remote attackers to exploit other vulnerabilities in phpMyAdmin by modifying the import_blacklist variable in grab_globals.php, which can then be used to overwrite other variables. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2005-1392 [MEDIUM] CVE-2005-1392: phpmyadmin - The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permis... The SQL install script in phpMyAdmin 2.6.2 is created with world-readable permissions, which allows local users to obtain the initial database password by reading the script. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2004-1147 [CRITICAL] CVE-2004-1147: phpmyadmin - phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformat... phpMyAdmin 2.6.0-pl2, and other versions before 2.6.1, with external transformations enabled, allows remote attackers to execute arbitrary commands via shell metacharacters. Scope: local bookworm: resolved (fixed in 2:2.6.1-rc1-1) bullseye: resolved (fixed in 2:2.6.1-rc1-1) forky: resolved (fixed in 2:2.6.1-rc1-1) sid: resolved (fixed in 2:2.6.1-rc1-1) trixie:

CVE-2004-2632 [HIGH] CVE-2004-2632: phpmyadmin - phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration set... phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables. Scope: local bookworm: resolved (fixed in 1:2.5.7-pl1-1) bullseye: resolved (fixed in 1:2.5.7-pl1-1) forky: resolved (fixed in 1:2.5.7-pl1-1) sid: resolved (fixed in 1:2.5.7-pl1-1) trixie: resolv

CVE-2004-2631 [HIGH] CVE-2004-2631: phpmyadmin - Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when L... Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name. Scope: local bookworm: resolved (fixed in 1:2.5.7-pl1-1) bullseye: resolved (fixed in 1:2.5.7-pl1-1) forky: resolved (fixed in 1:2.5.7-pl1-1) sid: resolved (fixed in 1:2.5.7-pl1-1) tr

CVE-2004-2630 [HIGH] CVE-2004-2630: phpmyadmin - The MIME transformation system (transformations/text_plain__external.inc.php) in... The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. Scope: local bookworm: resolved (fixed in 2:2.6.0-pl2-1) bullseye: resolved (fixed in 2:2.6.0-pl2-1) forky: resolved (fixed in 2:2.6.0-pl2-1) sid: res

CVE-2004-1055 [MEDIUM] CVE-2004-1055: phpmyadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and ... Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser. Scope: local bookworm: resolved (fixed i

CVE-2004-0129 [MEDIUM] CVE-2004-0129: phpmyadmin - Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier ... Directory traversal vulnerability in export.php in phpMyAdmin 2.5.5 and earlier allows remote attackers to read arbitrary files via .. (dot dot) sequences in the what parameter. Scope: local bookworm: resolved (fixed in 2:2.6.0-pl2) bullseye: resolved (fixed in 2:2.6.0-pl2) forky: resolved (fixed in 2:2.6.0-pl2) sid: resolved (fixed in 2:2.6.0-pl2) trixie: resolv

CVE-2004-1148 [MEDIUM] CVE-2004-1148: phpmyadmin - phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows re... phpMyAdmin before 2.6.1, when configured with UploadDir functionality, allows remote attackers to read arbitrary files via the sql_localfile parameter. Scope: local bookworm: resolved (fixed in 2:2.6.1-rc1-1) bullseye: resolved (fixed in 2:2.6.1-rc1-1) forky: resolved (fixed in 2:2.6.1-rc1-1) sid: resolved (fixed in 2:2.6.1-rc1-1) trixie: resolved (fixed in 2:2.6