Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 8 | phpmyadmin | 4:4.2.12-2+deb8u3 |
Vulnerabilities 11
-
Critical 9.8
phpMyAdmin Improper Privilege Management
An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). T…
-
High 8.8
phpMyAdmin PHP code injection
An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10…
-
High 8.6
phpMyAdmin server-side request forgery (SSRF)
The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
-
Medium 6.5
phpMyAdmin Denial of service (DOS) attack in transformation feature
An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) ar…
-
Medium 5.9
phpMyAdmin DoS Vulnerability
An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.4), 4.4.x …
-
Unscored —
An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir …
-
Unscored —
XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-c…
-
Unscored —
An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection…
-
Unscored —
An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection at…
-
Unscored —
An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that …
-
Unscored —
An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protect…