Emanuel Bronshtein

Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript `innerHTML` as used when generating login forms, (2) links or (3) resources URLs, and (4) the `Display name` in a user profile.

The issue allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address, as WordPress does not consider octal and hexadecimal IP address formats when determining an intranet address.

A cross-site request forgery (CSRF) issue exists in the `wp ajax wp compression test` function, located in `wp-admin/includes/ajax-actions.php`, allowing remote attackers to hijack administrator authentication for requests that modify the script compression option.

A cross-site scripting (XSS) issue exists in the network settings page, allowing remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to inject arbitrary web script or HTML via crafted table parameters in the partition-range implementation in the table-structure page. This is due to multiple cross-site scripting (XSS) vulnerabilities in the `templates/table/structure/display partitions.phtml` file.

The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including server-privileges certificate data fields on the user privileges page, an "invalid JSON" error message in the error console, a database name in the central columns implementation, a group name, or a search name in the bookmarks implementation.

An issue was discovered in phpMyAdmin, where a specially crafted database name could be used to run arbitrary PHP commands through the array export feature.

An issue was discovered where a user can create a specially crafted symlink on disk to a file that phpMyAdmin is permitted to read but the user is not. This allows phpMyAdmin to expose the file to the user.

An issue was discovered involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system.

An issue allows an authorized user to cause a denial-of-service (DoS) attack on a server by passing large values to a loop.

An issue was discovered involving improper enforcement of IP-based authentication rules. When used with IPv6 in a proxy server environment, where the proxy server is in the allowed range but the attacking computer is not, this issue can allow the attacking computer to connect despite the IP rules.

An issue in phpMyAdmin allows a user to execute a remote code execution attack against a server when phpMyAdmin is run as a CGI application. Under certain server configurations, a user can pass a query string that is executed as a command-line argument by the file generator plugin.sh.

An issue was discovered that allows bypassing the AllowRoot restriction and deny rules for usernames by using a Null Byte in the username.

An issue was discovered that allows for XSS due to a weakness in a regular expression used in some JavaScript processing.

An issue was discovered in phpMyAdmin. When the `arg separator` is different from its default '&' value, the CSRF token was not properly stripped from the return URL of the preference import action.

The issue concerns an open redirect weakness.

The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including a crafted table name, a crafted mysqld log bin directive, the Transformation implementation, AJAX error handling, the Designer implementation, the charts implementation, or the zoom-search implementation.

The issue allows remote attackers to obtain sensitive information via an invalid request. This request reveals the installation path in an error message. The problem is related to Error.class.php and Error Handler.class.php.

The issue allows remote attackers to obtain sensitive information via an invalid request, which reveals the installation path in an error message. This is related to config.default.php and other files.

The issue allows remote attackers to obtain sensitive information via an invalid request. This request reveals the installation path in an error message. The problem is related to pmd common.php and other files.