MySQL

CVEs (576)

• CVE-2008-4097Sep 18, 2008
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  MySQL 5.0.51a allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are associated with symlinks within pathnames for subdirectories of the MySQL home data directory,…

• CVE-2008-2079May 5, 2008
  MySQL

  MySQL
  risk 0.00cvss —epss 0.03

  MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are within the MySQL…

• CVE-2007-6304Dec 10, 2007
  MySQL

  MySQL
  risk 0.00cvss —epss 0.03

  The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the…

• CVE-2007-6303Dec 10, 2007
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW…

• CVE-2007-5970Dec 10, 2007
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  MySQL 5.1.x before 5.1.23 and 6.0.x before 6.0.4 allows remote authenticated users to gain privileges on arbitrary tables via unspecified vectors involving use of table-level DATA DIRECTORY and INDEX DIRECTORY options when creating a partitioned table with the same name as a…

• CVE-2007-2692May 16, 2007
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.

• CVE-2007-2693May 16, 2007
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.

• CVE-2006-4226Aug 18, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.03

  MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when run on case-sensitive filesystems, allows remote authenticated users to create or access a database when the database name differs only in case from a database for which they have permissions.

• CVE-2006-4031Aug 9, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user's privileges are revoked for the original table, which might violate intended security policy.

• CVE-2006-3486Jul 10, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.01

  Off-by-one buffer overflow in the Instance_options::complete_initialization function in instance_options.cc in the Instance Manager in MySQL before 5.0.23 and 5.1 before 5.1.12 might allow local users to cause a denial of service (application crash) via unspecified vectors,…

• CVE-2006-2753Jun 1, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.04

  SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x before 5.0.22 allows context-dependent attackers to execute arbitrary SQL commands via crafted multibyte encodings in character sets such as SJIS, BIG5, and GBK, which are not properly handled when the…

• CVE-2006-1517May 5, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.05

  sql_parse.cc in MySQL 4.0.x up to 4.0.26, 4.1.x up to 4.1.18, and 5.0.x up to 5.0.20 allows remote attackers to obtain sensitive information via a COM_TABLE_DUMP request with an incorrect packet length, which includes portions of memory in an error message.

• CVE-2006-0369Jan 22, 2006
  MySQL

  MySQL
  risk 0.00cvss —epss 0.01

  MySQL 5.0.18 allows local users with access to a VIEW to obtain sensitive information via the "SELECT * FROM information_schema.views;" query, which returns the query that created the VIEW. NOTE: this issue has been disputed by third parties, saying that the availability of the…

• CVE-2005-2558Aug 16, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.

• CVE-2005-2573Aug 16, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.03

  The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash…

• CVE-2005-2572Aug 16, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.05

  MySQL, when running on Windows, allows remote authenticated users with insert privileges on the mysql.func table to cause a denial of service (server hang) and possibly execute arbitrary code via (1) a request for a non-library file, which causes the Windows LoadLibraryEx…

• CVE-2005-1636May 17, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.01

  mysql_install_db in MySQL 4.1.x before 4.1.12 and 5.x up to 5.0.4 creates the mysql_install_db.X file with a predictable filename and insecure permissions, which allows local users to execute arbitrary SQL commands by modifying the file's contents.

• CVE-2005-0004Apr 14, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.01

  The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before 4.1.10, 5.0.x before 5.0.3, and other versions including 3.x, allows local users to overwrite arbitrary files or read temporary files via a symlink attack on temporary files.

• CVE-2005-0799Mar 15, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.03

  MySQL 4.1.9, and possibly earlier versions, allows remote attackers with certain privileges to cause a denial of service (application crash) via a use command followed by an MS-DOS device name such as (1) LPT1 or (2) PRN.

• CVE-2004-0957Feb 9, 2005
  MySQL

  MySQL
  risk 0.00cvss —epss 0.02

  Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), grants privileges to other databases that have similar names, which can allow the user to conduct unauthorized activities.