CVE - CVE-2016-2560

CVE-ID
CVE-2016-2560	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078 CONFIRM:https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4 CONFIRM:https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc CONFIRM:https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae58628a248458ea32 CONFIRM:https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb22dd83033675f CONFIRM:https://www.phpmyadmin.net/security/PMASA-2016-11/ DEBIAN:DSA-3627 URL:http://www.debian.org/security/2016/dsa-3627 FEDORA:FEDORA-2016-02ee5b4002 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178869.html FEDORA:FEDORA-2016-65da02b95c URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178562.html SUSE:openSUSE-SU-2016:0663 URL:http://lists.opensuse.org/opensuse-updates/2016-03/msg00018.html SUSE:openSUSE-SU-2016:0666 URL:http://lists.opensuse.org/opensuse-updates/2016-03/msg00020.html
Assigning CNA
MITRE Corporation
Date Record Created
20160225	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160225)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)