diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0617551f1b15..7e56a550b37c 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,56 @@ Note: Please add new entries to the beginning of this file. --> + + phpmyadmin -- multiple vulnerabilities + + + phpmyadmin + 3.4.3.1 + + + + +

The phpMyAdmin development team reports:

+
+

It was possible to manipulate the PHP session superglobal using + some of the Swekey authentication code. This could open a path for + other attacks.

+
+
+

An unsanitized key from the Servers array is written in a comment + of the generated config. An attacker can modify this key by + modifying the SESSION superglobal array. This allows the attacker to + close the comment and inject code.

+
+
+

Through a possible bug in PHP running on Windows systems a null + byte can truncate the pattern string allowing an attacker to inject + the /e modifier causing the preg_replace function to execute its + second argument as PHP code.

+
+
+

Fixed filtering of a file path in the MIME-type transformation + code, which allowed for directory traversal.

+
+ + + + CVE-2011-2505 + CVE-2011-2506 + CVE-2011-2507 + CVE-2011-2508 + http://www.phpmyadmin.net/home_page/security/PMASA-2011-5.php + http://www.phpmyadmin.net/home_page/security/PMASA-2011-6.php + http://www.phpmyadmin.net/home_page/security/PMASA-2011-7.php + http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php + + + 2011-07-02 + 2011-07-03 + + + asterisk -- multiple vulnerabilities