phpmyadmin phpmyadmin 4.0.10.4 vulnerabilities and exploits

(subscribe to this query)

An issue exists in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (before 4.0.10.16) are affected.

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote malicious users to guess passwords via a brute-force approach.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.4, 4.1.x prior to 4.1.14.5, and 4.2.x prior to 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during render...

libraries/config/messages.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.12, 4.4.x prior to 4.4.15.2, and 4.5.x prior to 4.5.3.1 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.6, 4.1.x prior to 4.1.14.7, and 4.2.x prior to 4.2.12 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database, (2) table, or (3) column name that is ...

libraries/select_lang.lib.php in phpMyAdmin 4.0.x prior to 4.0.10.9, 4.2.x prior to 4.2.13.2, and 4.3.x prior to 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier fo...

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.5, 4.1.x prior to 4.1.14.6, and 4.2.x prior to 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to th...

phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

libraries/session.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 does not properly generate CSRF token values, which allows remote malicious users to bypass intended access restrictions by predicting a value.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) host...

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook