Vulnerabilities > Mysql

DATE CVE VULNERABILITY TITLE RISK
2017-10-27 CVE-2017-15945 Incorrect Permission Assignment for Critical Resource vulnerability in multiple products
The installation scripts in the Gentoo dev-db/mysql, dev-db/mariadb, dev-db/percona-server, dev-db/mysql-cluster, and dev-db/mariadb-galera packages before 2017-09-29 have chown calls for user-writable directory trees, which allows local users to gain privileges by leveraging access to the mysql account for creation of a link.
local
low complexity
mariadb mysql gentoo CWE-732
7.2
2017-08-05 CVE-2017-12419 Information Exposure vulnerability in Mantisbt 2.5.2
If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_infile, or the MySQL client config file, depending on the PHP setup), an attacker may take advantage of MySQL's "connect file read" feature to remotely access files on the MantisBT server.
network
low complexity
mantisbt mariadb mysql CWE-200
4.0
2015-04-16 CVE-2015-2575 Remote Security vulnerability in Oracle MySQL Connectors
Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.
network
debian suse mysql
4.9
2013-03-28 CVE-2013-1492 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.
network
low complexity
mysql oracle CWE-119
7.5
2013-03-28 CVE-2012-0553 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492.
network
low complexity
mysql oracle CWE-119
7.5
2012-08-17 CVE-2012-2749 Resource Management Errors vulnerability in multiple products
MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.
network
low complexity
mysql oracle CWE-399
4.0
2012-08-17 CVE-2012-2102 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service (assertion failure and mysqld abort) by deleting a record and using HANDLER READ NEXT.
network
mysql oracle CWE-119
3.5
2012-08-17 CVE-2009-5026 SQL Injection vulnerability in multiple products
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
network
mysql oracle CWE-89
6.8
2012-05-03 CVE-2012-1696 Remote MySQL Server vulnerability in Oracle MySQL
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
network
low complexity
mysql oracle
4.0
2012-05-03 CVE-2012-0583 Remote MySQL Server vulnerability in Oracle MySQL
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.60 and earlier, and 5.5.19 and earlier, allows remote authenticated users to affect availability, related to MyISAM.
network
low complexity
mysql oracle
4.0