MySQL

CVEs (1,394)

• CVE-2002-1374Dec 23, 2002
  MySQL

  MySQL
  risk 0.05cvss —epss 0.20

  The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real…

• CVE-2012-5627Oct 1, 2013
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.11

  Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force…

• CVE-2013-1861Mar 28, 2013
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.19

  MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that…

• CVE-2012-5615Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.15

  Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid…

• CVE-2012-5614Dec 3, 2012
  MariaDB

  MariaDB
  risk 0.04cvss —epss 0.13

  Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users to cause a denial of service (mysqld crash) via a SELECT command with an UpdateXML command containing XML with a large number of unique,…

• CVE-2009-5026Aug 17, 2012
  MySQL

  MySQL
  risk 0.04cvss —epss 0.08

  The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.

• CVE-2010-3683Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.12

  Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 sends an OK packet when a LOAD DATA INFILE request generates SQL errors, which allows remote authenticated users to cause a denial of service (mysqld daemon crash) via a crafted request.

• CVE-2010-3682Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.11

  Oracle MySQL 5.1 before 5.1.49 and 5.0 before 5.0.92 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using EXPLAIN with crafted "SELECT ... UNION ... ORDER BY (SELECT ... WHERE ...)" statements, which triggers a NULL pointer dereference in…

• CVE-2010-3681Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.12

  Oracle MySQL 5.1 before 5.1.49 and 5.5 before 5.5.5 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by using the HANDLER interface and performing "alternate reads from two indexes on a table," which triggers an assertion failure.

• CVE-2010-3680Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.12

  Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) by creating temporary tables with nullable columns while using InnoDB, which triggers an assertion failure.

• CVE-2010-3679Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.12

  Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (mysqld daemon crash) via certain arguments to the BINLOG command, which triggers an access of uninitialized memory, as demonstrated by valgrind.

• CVE-2010-3678Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.12

  Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (crash) via (1) IN or (2) CASE operations with NULL arguments that are explicitly specified or indirectly provided by the WITH ROLLUP modifier.

• CVE-2010-3676Jan 11, 2011
  MySQL

  MySQL
  risk 0.04cvss —epss 0.09

  storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage…

• CVE-2010-2008Jul 13, 2010
  MySQL

  MySQL
  risk 0.04cvss —epss 0.09

  MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence,…

• CVE-2009-4019Nov 30, 2009
  MySQL

  MySQL
  risk 0.04cvss —epss 0.16

  mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function,…

• CVE-2009-2446Jul 13, 2009
  MySQL

  MySQL
  risk 0.04cvss —epss 0.11

  Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string…

• CVE-2009-0819Mar 5, 2009
  MySQL

  MySQL
  risk 0.04cvss —epss 0.10

  sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion…

• CVE-2008-4456Oct 6, 2008
  MySQL

  MySQL
  risk 0.04cvss —epss 0.07

  Cross-site scripting (XSS) vulnerability in the command-line client in MySQL 5.0.26 through 5.0.45, and other versions including versions later than 5.0.45, when the --html option is enabled, allows attackers to inject arbitrary web script or HTML by placing it in a database…

• CVE-2008-3963Sep 11, 2008
  MySQL

  MySQL
  risk 0.04cvss —epss 0.06

  MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6.0.6 does not properly handle a b'' (b single-quote single-quote) token, aka an empty bit-string literal, which allows remote attackers to cause a denial of service (daemon crash) by using this token in a SQL statement.

• CVE-2007-2583May 10, 2007
  MySQL

  MySQL
  risk 0.04cvss —epss 0.11

  The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to cause a denial of service (crash) via a crafted IF clause that results in a divide-by-zero error and a NULL pointer dereference.