oss-security - Re: CVE request: phpmyadmin

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 15 Jul 2008 21:09:03 +0200
From: Thijs Kinkhorst <thijs@...ian.org>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: phpmyadmin < 2.11.7.1

On Tuesday 15 July 2008 21:00, Hanno Böck wrote:
> From Changelog:
> - protection against XSS when register_globals is on and .htaccess
>   has no effect, thanks to Tim Starling

Note: this has already been assigned CVE-2008-2960 following a previous 
request from you.

> - (2.11.7.1)  [security] XSRF/CSRF by manipulating the db,
>   convcharset and collation_connection parameters,
>   thanks to YGN Ethical Hacker Group

This still needs one.


Thijs

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.