Search for packages
| purl | pkg:composer/phpmyadmin/phpmyadmin@4.6.3 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1dc8-kafr-3qd7
Aliases: CVE-2016-6628 GHSA-phhm-63xx-v9rr |
Cross-site Scripting An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-64sy-unts-juf3
Aliases: CVE-2016-6625 GHSA-r643-7xfg-ppc5 |
Information Exposure An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user session, username, and password are not compromised by this vulnerability. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-8fu3-wm7d-qkeu
Aliases: CVE-2016-6632 GHSA-426q-975p-w5cr |
Incomplete Cleanup An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-9t2s-etzf-t3d2
Aliases: CVE-2016-6609 GHSA-wpww-hx7x-xfjh |
Command Injection An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-e9qs-mvaa-wyc6
Aliases: CVE-2016-6624 GHSA-mhxj-6vf8-mwv3 |
Incomplete List of Disallowed Inputs An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-fgr8-8j61-cufq
Aliases: CVE-2016-6612 GHSA-fcgm-62p3-f7cm |
Information Exposure An issue was discovered in phpMyAdmin. A user can exploit the "LOAD LOCAL INFILE" functionality to expose files on the server to the database system. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-fvnp-w4kk-3qfq
Aliases: CVE-2016-6608 GHSA-jfmj-27fp-qp67 |
Cross-site Scripting XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-gzqe-8ywj-h7hk
Aliases: CVE-2016-9847 GHSA-9xhq-pm7v-693p |
Cryptographic Issues An issue was discovered in phpMyAdmin. When the user does not specify a `blowfish_secret` key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's `blowfish_secret` and potentially decrypt their cookies. |
Affected by 3 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-h5wu-ugm7-4bah
Aliases: CVE-2016-6633 GHSA-p849-vf5f-f3x7 |
Code Injection An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-tydk-zjv1-nye6
Aliases: CVE-2016-6622 GHSA-qf3f-7x69-qfv3 |
Improper Input Validation An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with `$cfg['AllowArbitraryServer']=true`. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-v66b-3ghf-9uas
Aliases: CVE-2016-6629 GHSA-567r-vqj7-5cw7 |
Improper Input Validation An issue was discovered in phpMyAdmin involving the `$cfg['ArbitraryServerRegexp']` configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by `ArbitraryServerRegexp`. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-z22z-a5bq-97d3
Aliases: CVE-2016-6618 GHSA-rv6m-chvv-wmxg |
Uncontrolled Resouce Consumption An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-zg16-dfu1-g7dn
Aliases: CVE-2016-6613 GHSA-6j2v-g9rg-qcm5 |
Information Exposure An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. |
Affected by 5 other vulnerabilities. Affected by 22 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||