From f7d1c1f46382e7e6464fd92529d4410e635805f1 Mon Sep 17 00:00:00 2001 From: Isaac Bennetch Date: Wed, 22 Jun 2016 23:53:56 -0400 Subject: [PATCH] Changelog entries for security release Signed-off-by: Isaac Bennetch --- ChangeLog | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4250d08e04..5dbf14dfce 100644 --- a/ChangeLog +++ b/ChangeLog @@ -14,6 +14,20 @@ phpMyAdmin - ChangeLog - issue #12303 Fix table size calculation in some circumstances - issue #12310 Fix listing routines for non privileged user - issue Escape generated query in exporting a database +- issue Setup script doesn't use input type 'password' in all relevant locations +- issue [security] BBCode injection in setup script, see PMASA-2016-17 +- issue [security] Cookie attribute injection attack, see PMASA-2016-18 +- issue Redirect loop when directly calling url.php +- issue [security] SQL injection attack, see PMASA-2016-19 +- issue [security] XSS attack in Table Structure page, see PMASA-2016-20 +- issue [security] XSS attack in Server Privileges page, see PMASA-2016-21 +- issue [security] DOS attack vulnerability, see PMASA-2016-22 +- issue [security] Multiple full path disclosure vulnerabilities, see PMASA-2016-23 +- issue [security] Full path disclosure when running in debug mode +- issue [security] XSS attack with partition range and table structure, see PMASA-2016-25 +- issue [security] XSS attack when checking database privileges, see PMASA-2016-26 +- issue [security] XSS attack when MySQL server is using a specific payload log_bin directive, see PMASA-2016-26 +- issue [security] XSS vulnerabilities in Transformation feature, see PMASA-2016-26 4.6.2 (2016-05-25) - issue [security] User SQL queries can be revealed through URL GET parameters, see PMASA-2016-14