phpmyadmin phpmyadmin 4.0.10.7 vulnerabilities and exploits

(subscribe to this query)

An issue exists in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (before 4.0.10.16) are affected.

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote malicious users to guess passwords via a brute-force approach.

libraries/config/messages.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.12, 4.4.x prior to 4.4.15.2, and 4.5.x prior to 4.5.3.1 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, and 4.4.x prior to 4.4.6.1 allow remote malicious users to hijack the authentication of administrators for req...

libraries/Config.class.php in phpMyAdmin 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, and 4.4.x prior to 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle malicious users to spoof servers a...

libraries/select_lang.lib.php in phpMyAdmin 4.0.x prior to 4.0.10.9, 4.2.x prior to 4.2.13.2, and 4.3.x prior to 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier fo...

phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 allows remote malicious users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) host...

libraries/common.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote malicious users to bypass intended access restrictions by measurin...

libraries/session.inc.php in phpMyAdmin 4.0.x prior to 4.0.10.13, 4.4.x prior to 4.4.15.3, and 4.5.x prior to 4.5.4 does not properly generate CSRF token values, which allows remote malicious users to bypass intended access restrictions by predicting a value.

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook