From 7f57c9182c3dd58205ad4b7ca12450f767343092 Mon Sep 17 00:00:00 2001 From: Marcus Alves Grando Date: Thu, 6 Apr 2006 16:44:46 +0000 Subject: [PATCH] phpmyadmin -- XSS vulnerabilities phpmyadmin -- 'set_theme' Cross-Site Scripting --- security/vuxml/vuln.xml | 58 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 2ef820601819..22311b16dc39 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,64 @@ Note: Please add new entries to the beginning of this file. --> + + phpmyadmin -- XSS vulnerabilities + + + phpMyAdmin + 2.8.0.3 + + + + +

phpMyAdmin security announcement:

+
+

It was possible to conduct an XSS attack with a direct call + to some scripts under the themes directory.

+
+ + + + http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-1 + + + 2006-04-06 + 2006-04-06 + + + + + phpmyadmin -- 'set_theme' Cross-Site Scripting + + + phpMyAdmin + 2.8.0.2 + + + + +

Secunia reports:

+
+

A vulnerability has been reported in phpMyAdmin, which can be + exploited by malicious people to conduct cross-site scripting + attacks.

+

Input passed to the "set_theme" parameter isn't properly + sanitised before being returned to the user. This can be exploited + to execute arbitrary HTML and script code in a user's browser + session in context of an affected site.

+
+ + + + CVE-2006-1258 + http://secunia.com/advisories/19277 + + + 2006-03-17 + 2006-04-06 + + + clamav -- Multiple Vulnerabilities