Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 8 | phpmyadmin | 4:4.2.12-2+deb8u6 |
Vulnerabilities 16
-
High 7.5
phpMyAdmin Bypass white-list protection for URL redirection
An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affecte…
-
Medium 6.5
phpMyAdmin Local file exposure
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17…
-
Medium 6.5
phpMyAdmin CSRF Vulnerability
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAd…
-
Medium 6.3
phpMyAdmin Reflected File Download attack
An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
-
Medium 5.9
phpMyAdmin IPv6 and proxy server IP-based authentication rule circumvention
An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed,…
-
Medium 5.9
phpMyAdmin Denial of service (DOS) attack with dbase extension
An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) …
-
Medium 5.3
phpMyAdmin Local file exposure through symlinks with UploadDir
An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior…
-
Unscored —
XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to tri…
-
Unscored —
An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL inj…
-
Unscored —
An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (p…
-
Unscored —
An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php.…
-
Unscored —
An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a…
-
Unscored —
An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdm…
-
Unscored —
An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']…
-
Unscored —
An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detec…
-
Unscored —
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statement…