suse/mariadb&distro=SUSE OpenStack Cloud 7

Vulnerabilities (83)

• CVE-2020-15180CriMay 27, 2021
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, i

• CVE-2020-14812MedOct 21, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Locking). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multi

• CVE-2020-14789MedOct 21, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compr

• CVE-2020-14776MedOct 21, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise

• CVE-2020-14765MedOct 21, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple p

• CVE-2020-13249HigMay 20, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. NOTE: although mariadb_lib.c was originally based on code shipped for MySQL, this issue does not affect any MySQL components supported by Or

• CVE-2020-2814MedApr 15, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple proto

• CVE-2020-2812MedApr 15, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access

• CVE-2020-2760MedApr 15, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise

• CVE-2020-2752MedApr 15, 2020
  affected < 10.2.36-19.1fixed 10.2.36-19.1

  Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple proto

• CVE-2019-18901MedMar 2, 2020
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Li

• CVE-2020-2574MedJan 15, 2020
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple prot

• CVE-2019-2974MedOct 16, 2019
  affected < 10.0.40.2-29.35.1fixed 10.0.40.2-29.35.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via mult

• CVE-2019-2938MedOct 16, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromi

• CVE-2017-1002201MedOct 15, 2019
  affected < 10.2.25-13.1fixed 10.2.25-13.1

  In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially e

• CVE-2019-2805MedJul 23, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via mu

• CVE-2019-2758MedJul 23, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compr

• CVE-2019-2740MedJul 23, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: XML). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multi

• CVE-2019-2739MedJul 23, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with logon

• CVE-2019-2737MedJul 23, 2019
  affected < 10.2.31-16.1fixed 10.2.31-16.1

  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Pluggable Auth). Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network acc