MySQL

CVEs (576)

• CVE-2016-8284LowOct 25, 2016
  Oracle Corporation

  MySQL
  risk 0.12cvss 1.8epss 0.00

  Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.

• CVE-2012-2122Jun 26, 2012
  MariaDB

  MariaDB
  risk 0.11cvss —epss 0.96

  sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp…

• CVE-2008-0226Jan 10, 2008
  MySQL

  MySQL
  risk 0.10cvss —epss 0.92

  Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

• CVE-2009-4484Dec 30, 2009
  MySQL

  MySQL
  risk 0.09cvss —epss 0.70

  Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to…

• CVE-2003-0780Sep 22, 2003
  MySQL

  MySQL
  risk 0.09cvss —epss 0.75

  Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.

• CVE-2003-0150Mar 24, 2003
  MySQL

  MySQL
  risk 0.07cvss —epss 0.45

  MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.

• CVE-2012-5613Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.06cvss —epss 0.32

  MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to users who should not have administrative privileges, allows remote authenticated users to gain privileges by leveraging the FILE privilege…

• CVE-2006-1516May 5, 2006
  MySQL

  MySQL
  risk 0.06cvss —epss 0.34

  The check_connection function in sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to read portions of memory via a username without a trailing null byte, which causes a buffer over-read.

• CVE-2006-1518May 5, 2006
  MySQL

  MySQL
  risk 0.06cvss —epss 0.36

  Buffer overflow in the open_table function in sql_base.cc in MySQL 5.0.x up to 5.0.20 might allow remote attackers to execute arbitrary code via crafted COM_TABLE_DUMP packets with invalid length values.

• CVE-2015-4870Oct 21, 2015
  Fedoraproject

  Fedora
  risk 0.05cvss —epss 0.30

  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

• CVE-2012-5612Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.05cvss —epss 0.21

  Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code, as demonstrated…

• CVE-2012-5611Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.05cvss —epss 0.25

  Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote…

• CVE-2006-3469Jul 21, 2006
  MySQL

  MySQL
  risk 0.05cvss —epss 0.27

  Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later…

• CVE-2006-3081Jun 19, 2006
  MySQL

  MySQL
  risk 0.05cvss —epss 0.22

  mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) via a NULL second argument to the str_to_date function.

• CVE-2004-0835Nov 3, 2004
  MySQL

  MySQL
  risk 0.05cvss —epss 0.22

  MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities.

• CVE-2002-1375Dec 23, 2002
  MySQL

  MySQL
  risk 0.05cvss —epss 0.24

  The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response.

• CVE-2002-1374Dec 23, 2002
  MySQL

  MySQL
  risk 0.05cvss —epss 0.20

  The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real…

• CVE-2012-5627Oct 1, 2013
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.11

  Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force…

• CVE-2013-1861Mar 28, 2013
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.19

  MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that…

• CVE-2012-5615Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.15

  Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid…