Emanuel Bronshtein

**Name of the Vulnerable Software and Affected Versions** Mahara versions 1.4.x through 1.4.2 Mahara versions 1.5.x through 1.5.1 **Description** Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript `innerHTML` as used when generating login forms, (2) links or (3) resources URLs, and (4) the `Display name` in a user profile. **Recommendations** For Mahara versions 1.4.x through 1.4.2, update to version 1.4.3 or later. For Mahara versions 1.5.x through 1.5.1, update to version 1.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.5 **Description** The issue allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address, as WordPress does not consider octal and hexadecimal IP address formats when determining an intranet address. **Recommendations** For WordPress versions prior to 4.5, update to version 4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to internal network resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.5 **Description** A cross-site request forgery (CSRF) issue exists in the `wp ajax wp compression test` function, located in `wp-admin/includes/ajax-actions.php`, allowing remote attackers to hijack administrator authentication for requests that modify the script compression option. **Recommendations** For versions prior to 4.5, update to version 4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `wp-admin/includes/ajax-actions.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WordPress versions prior to 4.5 **Description** A cross-site scripting (XSS) issue exists in the network settings page, allowing remote attackers to inject arbitrary web script or HTML. **Recommendations** For versions prior to 4.5, update to version 4.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.6.0 through 4.6.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via crafted table parameters in the partition-range implementation in the table-structure page. This is due to multiple cross-site scripting (XSS) vulnerabilities in the `templates/table/structure/display partitions.phtml` file. **Recommendations** For phpMyAdmin versions 4.6.0 through 4.6.2, update to version 4.6.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including server-privileges certificate data fields on the user privileges page, an "invalid JSON" error message in the error console, a database name in the central columns implementation, a group name, or a search name in the bookmarks implementation. **Recommendations** For phpMyAdmin versions 4.4.x through 4.4.15.6, update to version 4.4.15.7 or later. For phpMyAdmin versions 4.6.x through 4.6.2, update to version 4.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x through 4.0.10.16 phpMyAdmin versions 4.4.x through 4.4.15.7 phpMyAdmin versions 4.6.x through 4.6.3 **Description** An issue was discovered in phpMyAdmin, where a specially crafted database name could be used to run arbitrary PHP commands through the array export feature. **Recommendations** For phpMyAdmin versions 4.0.x through 4.0.10.16, update to version 4.0.10.17 or later. For phpMyAdmin versions 4.4.x through 4.4.15.7, update to version 4.4.15.8 or later. For phpMyAdmin versions 4.6.x through 4.6.3, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x prior to 4.0.10.17 phpMyAdmin versions 4.4.x prior to 4.4.15.8 phpMyAdmin versions 4.6.x prior to 4.6.4 **Description** An issue was discovered where a user can create a specially crafted symlink on disk to a file that phpMyAdmin is permitted to read but the user is not. This allows phpMyAdmin to expose the file to the user. **Recommendations** For versions 4.0.x prior to 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.x prior to 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.x prior to 4.6.4, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.0 through 4.0.10.17 phpMyAdmin versions 4.4.0 through 4.4.15.8 phpMyAdmin versions 4.6.0 through 4.6.4 **Description** An issue was discovered involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. **Recommendations** For versions 4.0.0 through 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.0 through 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.0 through 4.6.4, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x prior to 4.0.10.17 phpMyAdmin versions 4.4.x prior to 4.4.15.8 phpMyAdmin versions 4.6.x prior to 4.6.4 **Description** An issue allows an authorized user to cause a denial-of-service (DoS) attack on a server by passing large values to a loop. **Recommendations** For versions 4.0.x prior to 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.x prior to 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.x prior to 4.6.4, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.0 through 4.0.10.17 phpMyAdmin versions 4.4.0 through 4.4.15.8 phpMyAdmin versions 4.6.0 through 4.6.4 **Description** An issue was discovered involving improper enforcement of IP-based authentication rules. When used with IPv6 in a proxy server environment, where the proxy server is in the allowed range but the attacking computer is not, this issue can allow the attacking computer to connect despite the IP rules. **Recommendations** For versions 4.0.0 through 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.0 through 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.0 through 4.6.4, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x prior to 4.0.10.17 phpMyAdmin versions 4.4.x prior to 4.4.15.8 phpMyAdmin versions 4.6.x prior to 4.6.4 **Description** An issue in phpMyAdmin allows a user to execute a remote code execution attack against a server when phpMyAdmin is run as a CGI application. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator plugin.sh. **Recommendations** For versions 4.0.x prior to 4.0.10.17, update to version 4.0.10.17 or later. For versions 4.4.x prior to 4.4.15.8, update to version 4.4.15.8 or later. For versions 4.6.x prior to 4.6.4, update to version 4.6.4 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.0 through 4.0.10.17 phpMyAdmin versions 4.4.0 through 4.4.15.8 phpMyAdmin versions 4.6.0 through 4.6.4 **Description** An issue was discovered that allows bypassing the AllowRoot restriction and deny rules for usernames by using a Null Byte in the username. **Recommendations** For versions 4.0.0 through 4.0.10.17, update to version 4.0.10.18 or later. For versions 4.4.0 through 4.4.15.8, update to version 4.4.15.9 or later. For versions 4.6.0 through 4.6.4, update to version 4.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x through 4.0.10.17 phpMyAdmin versions 4.4.x through 4.4.15.8 phpMyAdmin versions 4.6.x through 4.6.4 **Description** An issue was discovered that allows for XSS due to a weakness in a regular expression used in some JavaScript processing. **Recommendations** For versions 4.0.x through 4.0.10.17, update to version 4.0.10.18 or later. For versions 4.4.x through 4.4.15.8, update to version 4.4.15.9 or later. For versions 4.6.x through 4.6.4, update to version 4.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x prior to 4.0.10.18 phpMyAdmin versions 4.4.x prior to 4.4.15.9 phpMyAdmin versions 4.6.x prior to 4.6.5 **Description** An issue was discovered in phpMyAdmin. When the `arg separator` is different from its default '&' value, the CSRF token was not properly stripped from the return URL of the preference import action. **Recommendations** For versions 4.0.x prior to 4.0.10.18, update to version 4.0.10.18 or later. For versions 4.4.x prior to 4.4.15.9, update to version 4.4.15.9 or later. For versions 4.6.x prior to 4.6.5, update to version 4.6.5 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0 through 4.6 **Description** The issue concerns an open redirect weakness. **Recommendations** For versions 4.0 through 4.6, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x through 4.0.10.15 phpMyAdmin versions 4.4.x through 4.4.15.6 phpMyAdmin versions 4.6.x through 4.6.2 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including a crafted table name, a crafted mysqld log bin directive, the Transformation implementation, AJAX error handling, the Designer implementation, the charts implementation, or the zoom-search implementation. **Recommendations** For phpMyAdmin versions 4.0.x through 4.0.10.15, update to version 4.0.10.16 or later. For phpMyAdmin versions 4.4.x through 4.4.15.6, update to version 4.4.15.7 or later. For phpMyAdmin versions 4.6.x through 4.6.2, update to version 4.6.3 or later.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 4.0.x through 4.0.4.1 **Description** The issue allows remote attackers to obtain sensitive information via an invalid request. This request reveals the installation path in an error message. The problem is related to Error.class.php and Error Handler.class.php. **Recommendations** For phpMyAdmin versions 4.0.x through 4.0.4.1, update to version 4.0.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to Error.class.php and Error Handler.class.php to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 3.5.x through 3.5.8.1 **Description** The issue allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message. This is related to config.default.php and other files. **Recommendations** For phpMyAdmin versions 3.5.x through 3.5.8.1, update to version 3.5.8.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** phpMyAdmin versions 3.5.x through 3.5.8.1 phpMyAdmin versions 4.0.x through 4.0.4.1 **Description** The issue allows remote attackers to obtain sensitive information via an invalid request. This request reveals the installation path in an error message. The problem is related to pmd common.php and other files. **Recommendations** For phpMyAdmin versions 3.5.x through 3.5.8.1, update to version 3.5.8.2 or later. For phpMyAdmin versions 4.0.x through 4.0.4.1, update to version 4.0.4.2 or later.