Search for packages
| purl | pkg:composer/phpmyadmin/phpmyadmin@4.5.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-27kp-82xd-cucw
Aliases: CVE-2015-7873 GHSA-5pmg-qh2c-7j24 |
phpMyAdmin allows remote attackers to spoof content via the url parameter The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter. |
Affected by 4 other vulnerabilities. |
|
VCID-3yp5-vqej-r7hh
Aliases: CVE-2016-2040 GHSA-pw34-qf6c-84fc |
Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin allow remote authenticated users to inject arbitrary web script or HTML. |
Affected by 2 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-br1c-5bzf-ufeu
Aliases: CVE-2019-6798 GHSA-f732-fxh6-g4qj |
SQL Injection An issue was discovered in phpMyAdmin. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature. |
Affected by 12 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-f7gd-w9r7-xyb2
Aliases: CVE-2016-1927 GHSA-4gmg-gwjh-3mmr |
phpMyAdmin Cryptographic Vulnerability The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach. |
Affected by 2 other vulnerabilities. |
|
VCID-k7kn-ynne-b3gv
Aliases: CVE-2016-2559 GHSA-7rf8-9r8f-qf59 |
Cross-site Scripting A Cross-site scripting (XSS) vulnerability in the format function in `libraries/sql-parser/src/Utils/Error.php` in the SQL parser in phpMyAdmin allows remote authenticated users to inject arbitrary web script or HTML via a crafted query. |
Affected by 0 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-nfuk-7739-xqaw
Aliases: CVE-2016-2562 GHSA-w8qg-j9fp-hrjf |
Improper Input Validation The `checkHTTP` function in `libraries/Config.class.php` in phpMyAdmin does not verify X.509 certificates from `api.github.com` SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate. |
Affected by 0 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-w37b-ep3h-tfaz
Aliases: CVE-2016-2041 GHSA-8m97-xc46-rw9w |
Covert Timing Channel `libraries/common.inc.php` in phpMyAdmin does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences. |
Affected by 2 other vulnerabilities. Affected by 22 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||