ID de Prueba:	1.3.6.1.4.1.25623.1.0.805398
Categoría:	Web application abuses
Título:	phpMyAdmin Multiple Vulnerabilities -01 (Jun 2015)
Resumen:	phpMyAdmin is prone to multiple vulnerabilities.
Descripción:	Summary: phpMyAdmin is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - 'libraries/Config.class.php' disables X.509 certificate verification for GitHub API calls over SSL - HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. Vulnerability Impact: Successfully exploiting this issue may allow attackers to obtain sensitive information by conducting a man-in-the-middle attack or by conducting a cross-site scripting attacks, Web cache poisoning, and other malicious activities. Affected Software/OS: phpMyAdmin versions 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 Solution: Upgrade to phpMyAdmin 4.0.10.10, or 4.2.13.3 or 4.3.13.1 or 4.4.6.1 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3902 BugTraq ID: 74657 http://www.securityfocus.com/bid/74657 Debian Security Information: DSA-3382 (Google Search) http://www.debian.org/security/2015/dsa-3382 http://www.securitytracker.com/id/1032404 SuSE Security Announcement: openSUSE-SU-2015:1191 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3903 BugTraq ID: 74660 http://www.securityfocus.com/bid/74660 Bugtraq: 20150514 phpMyAdmin 4.4.6 Man-In-the-Middle API Github (Google Search) http://www.securityfocus.com/archive/1/535547/100/0/threaded http://cxsecurity.com/issue/WLB-2015050095 http://packetstormsecurity.com/files/131954/phpMyAdmin-4.4.6-Man-In-The-Middle.html http://www.securitytracker.com/id/1032403
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.