CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10789
https://notcve.org/view.php?id=CVE-2017-10789
01 Jul 2017 — The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152. El módulo DBD::mysql hasta la versión 4.043 para Perl, usa la configuración mysql_ssl=1 para definir que SSL es opcional (aunque la documentación de esta configuración ... • http://www.securityfocus.com/bid/99364 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10788
https://notcve.org/view.php?id=CVE-2017-10788
01 Jul 2017 — The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering (1) certain error responses from a MySQL server or (2) a loss of a network connection to a MySQL server. The use-after-free defect was introduced by relying on incorrect Oracle mysql_stmt_close documentation and code examples. El módulo DBD::mysql hasta la versión 4.043 para Perl, permite a atacantes remotos causar un... • http://seclists.org/oss-sec/2017/q2/443 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2017-9602 – KBVault MySQL 0.16a - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2017-9602
16 Jun 2017 — KBVault Mysql Free Knowledge Base application package 0.16a comes with a FileExplorer/Explorer.aspx?id=/Uploads file-management component. An unauthenticated user can access the file upload and deletion functionality. Through this functionality, a user can upload an ASPX script to Uploads/Documents/ to run any arbitrary code. El paquete de la aplicación KBVault Mysql Free Knowledge 0.16a viene con un componente de manipulación de archivos FileExplorer/Explorer.aspx? • https://packetstorm.news/files/id/142982 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1249 – Gentoo Linux Security Advisory 201701-51
https://notcve.org/view.php?id=CVE-2016-1249
23 Jan 2017 — The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of service (out-of-bounds read) via vectors involving an unaligned number of placeholders in WHERE condition and output fields in SELECT expression. El módulo DBD::mysql en versiones anteriores a 4.039 para Perl, cuando se utiliza el soporte de sentencia preparada en el servidor, permite a atacantes provocar una denegación de servicio (lectura fuera de límites) a través de vecto... • http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.039/Changes • CWE-125: Out-of-bounds Read •
CVSS: 8.1EPSS: 0%CPEs: 69EXPL: 0CVE-2016-1251 – Gentoo Linux Security Advisory 201701-51
https://notcve.org/view.php?id=CVE-2016-1251
29 Nov 2016 — There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4.041 when used with mysql_server_prepare=1. Existe una vulnerabilidad de tipo uso después de liberación de memoria afectando a DBD::mysql (también conocido como DBD-mysql o el controlador Database Interface (DBI) MySQL para Perl) 3.x y 4.x en versiones anteriores a 4.041 cuando se usa con mysql_server_prepare=1. Multiple vulnerabilities have been foun... • http://www.openwall.com/lists/oss-security/2016/11/28/2 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2016-1246 – Gentoo Linux Security Advisory 201701-51
https://notcve.org/view.php?id=CVE-2016-1246
03 Oct 2016 — Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message. Desbordamiento de búfer en el módulo DBD::mysql en versiones anteriores a 4.037 para Perl permite a atacantes dependientes del contexto provocar una denegación de servicio (caída) a través de vectores relacionados con un mensaje de error. It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacke... • http://blogs.perl.org/users/mike_b/2016/10/security-release---buffer-overflow-in-dbdmysql-perl-library.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8949 – Gentoo Linux Security Advisory 201701-51
https://notcve.org/view.php?id=CVE-2015-8949
29 Jul 2016 — Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login. Vulnerabilidad de uso después de liberación de memoria en la función my_login en DBD::mysql en versiones anteriores a 4.033_01 permite a atacantes tener impacto no especificado aprovechando una llamada a mysql_errno despúes de un fallo de my_login. It was discovered that DBD::mysql incorrectly handled certain memory o... • http://www.debian.org/security/2016/dsa-3635 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9906 – Debian Security Advisory 3635-1
https://notcve.org/view.php?id=CVE-2014-9906
29 Jul 2016 — Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection. Vulnerabilidad de uso después de liberación de memoria en DBD::mysql en versiones anteriores a 4.029 permite a atacantes provocar una denegación de servicio (caída del programa) o posiblemente ejecutar código arbitrario a través de vectores relacionados con una conexión de servidor perdida. It was discovered ... • http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 3CVE-2015-6944 – JSPMySQL Administrador - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-6944
06 Sep 2015 — Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of users for requests that execute arbitrary SQL commands via the cmd parameter to sys/sys/listaBD2.jsp. Vulnerabilidad CSRF en JSP/MySQL Administrador Web 1, permite a atacantes remotos secuestrar la autenticación de usuarios para peticiones que ejecutan comandos SQL arbitrarios a través del parámetro cmd en sys/sys/listaBD2.jsp. JSPMySQL Administrador version 1 suffers from... • https://packetstorm.news/files/id/133466 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2015-6945 – JSPMySQL Administrador - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2015-6945
06 Sep 2015 — Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via the bd parameter to sys/sys/listaBD2.jsp. Vulnerabilidad de XSS en JSP/MySQL Administrador Web 1, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro bd en sys/sys/listaBD2.jsp. JSPMySQL Administrador version 1 suffers from cross site request forgery and cross site scripting vulnerabilities. • https://packetstorm.news/files/id/133466 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •