Mysql vulnerabilities
110 vulnerabilities
Known vulnerabilities in Mysql products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.
Products
8- Mysql92 vulnerabilities
- Maxdb10 vulnerabilities
- Community Server4 vulnerabilities
- Eventum2 vulnerabilities
- Mysql Community Server2 vulnerabilities
- Mysql Server2 vulnerabilities
- Mysql Enterprise Server1 vulnerabilities
- Winmysqladmin1 vulnerabilities
CVE-2003-1480mysqlmysql+1
EPSS score2.67%
MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods.CVE-2003-0780conectivalinux+3EPSS score78.37%
Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field.CVE-2013-1492mysqlmysql+1EPSS score2.83%
Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.CVE-2015-2575debianmysql-connector-java+10EPSS score3.56%
Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.CVE-2007-2691canonicalubuntu_linux+2EPSS score2.85%
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.CVE-2007-2693mysqlmysql+1EPSS score1.78%
MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.CVE-2007-2692mysqlmysql+1EPSS score1.88%
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.CVE-2007-1420mysqlmysql+1EPSS score1.03%
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function.CVE-2007-5969mysqlcommunity_server+2EPSS score14.26%
MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4, when a table relies on symlinks created through explicit DATA DIRECTORY and INDEX DIRECTORY options, allows remote authenticated users to overwrite system table information and gain privileges via a RENAME TABLE statement that changes the symlink to point to an existing file.CVE-2007-5925debianmysql-dfsg-5.0+1EPSS score11.35%
The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated users to cause a denial of service (database crash) via a certain CONTAINS operation on an indexed column, which triggers an assertion error.CVE-2007-6313mysqlmysql_community_serverEPSS score1.30%
MySQL Server 5.1.x before 5.1.23 and 6.0.x before 6.0.4 does not check the rights of the entity executing BINLOG, which allows remote authorized users to execute arbitrary BINLOG statements.CVE-2007-6303mysqlmysql+1EPSS score2.23%
MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.CVE-2007-6304mysqlmysql+1EPSS score2.96%
The federated engine in MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4, when performing a certain SHOW TABLE STATUS query, allows remote MySQL servers to cause a denial of service (federated handler crash and daemon crash) via a response that lacks the minimum required number of columns.CVE-2007-3781mysqlcommunity_serverEPSS score1.78%
MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure.CVE-2007-3780mysqlcommunity_server+6EPSS score14.05%
MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol.CVE-2007-3782mysqlcommunity_serverEPSS score1.57%
MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table.CVE-2001-1255mysqlwinmysqladmin+1EPSS score0.61%
WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database.CVE-2005-2558debianmysql+3EPSS score2.33%
Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote authenticated users who can create user-defined functions to execute arbitrary code via a long function_name field.CVE-2005-2573mysqlmysql+1EPSS score2.81%
The mysql_create_function function in sql_udf.cc for MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta, when running on Windows, uses an incomplete blacklist in a directory traversal check, which allows attackers to include arbitrary files via the backslash (\) character.CVE-2005-2467mysqleventumEPSS score2.87%
Multiple cross-site scripting (XSS) vulnerabilities in MySQL Eventum 1.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to view.php, (2) release parameter to list.php, or (3) F parameter to get_jsrs_data.php.