FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  446318
Date:      2017-07-21
Time:      14:38:40Z
Committer: olivier

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
db1d3340-e83b-11e1-999b-e0cb4e266481phpMyAdmin -- Multiple XSS in Table operations, Database structure, Trigger and Visualize GIS data pages

The phpMyAdmin development team reports:

Using a crafted table name, it was possible to produce a XSS : 1) On the Database Structure page, creating a new table with a crafted name 2) On the Database Structure page, using the Empty and Drop links of the crafted table name 3) On the Table Operations page of a crafted table, using the 'Empty the table (TRUNCATE)' and 'Delete the table (DROP)' links 4) On the Triggers page of a database containing tables with a crafted name, when opening the 'Add Trigger' popup 5) When creating a trigger for a table with a crafted name, with an invalid definition. Having crafted data in a database table, it was possible to produce a XSS : 6) When visualizing GIS data, having a crafted label name.

Discovery 2012-08-12
Entry 2012-08-17

aca0d7e0-e38a-11e1-999b-e0cb4e266481phpMyAdmin -- Path disclosure due to missing library

The phpMyAdmin development team reports:

The show_config_errors.php script does not include a library, so an error message shows the full path of this file, leading to possible further attacks.

Discovery 2012-08-03
Entry 2012-08-11

ef417da3-1640-11e2-999b-e0cb4e266481phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack

The phpMyAdmin development team reports:

When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS.

To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the website in non-SSL mode. A man-in-the-middle could modify this script on the wire to cause mischief.

Discovery 2012-10-08
Entry 2012-10-14
ge 3.5 lt 3.5.3