CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2007-3782 – New release of MySQL fixes security bugs
https://notcve.org/view.php?id=CVE-2007-3782
MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table. MySQL Community Server anterior a 5.0.45 permite a usuarios autenticados remotamente obtener privilegios de actualización (update) para una tabla en otra base de datos mediante una vista que se refiere a esta tabla externa. • http://bugs.mysql.com/bug.php?id=27878 http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-45.html http://lists.mysql.com/announce/470 http://secunia.com/advisories/25301 http://secunia.com/advisories/26073 http://secunia.com/advisories/26430 http://secunia.com/advisories/26710 http://secunia.com/advisories/26987 http://secunia.com/advisories/27155 http://secunia.com/advisories/27823 http://secunia.com/advisories/30351 http://securitytracker.com/id?101 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 11EXPL: 0CVE-2007-2693
https://notcve.org/view.php?id=CVE-2007-2693
MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement. MySQL anterior a 5.1.18 permite a usuarios autenticados remotamente sin privilegios SELECT obtener información sensible desde tablas particionadas mediante una sentencia ALTER TABLE. • http://bugs.mysql.com/bug.php?id=23675 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html http://secunia.com/advisories/25301 http://www.securityfocus.com/bid/24008 http://www.securitytracker.com/id?1018071 http://www.vupen.com/english/advisories/2007/1804 https://exchange.xforce.ibmcloud.com/vulnerabilities/34349 •
CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2007-2691 – mysql DROP privilege not enforced when renaming tables
https://notcve.org/view.php?id=CVE-2007-2691
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables. MySQL anterior a 4.1.23, 5.0.x anterior a 5.0.42, y 5.1.x anterior a 5.1.18 no requiere el privilegio DROP para sentencias RENAME TABLE, lo cual permite a usuarios autenticados remotamente renombrar tablas de su elección. • http://bugs.mysql.com/bug.php?id=27515 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html http://lists.mysql.com/announce/470 http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html http://osvdb.org/34766 http://secunia.com/advisories/25301 http://secunia.com/advisories/25946 http://secunia.com/advisories/26073 http://secunia.com/advisories/26430 http://secunia. •
CVSS: 6.0EPSS: 6%CPEs: 48EXPL: 0CVE-2007-2692 – mysql SECURITY INVOKER functions do not drop privileges
https://notcve.org/view.php?id=CVE-2007-2692
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges. La función mysql_change_db en MySQL 5.0.x anterior a 5.0.40 y 5.1.x anterior a 5.1.18 no restaura los privilegios THD::db_access cuando regresa de rutinas almacenadas SQL SECURITY INVOKER, lo cual permite a usuarios autenticados remotamente obtener privilegios. • http://bugs.mysql.com/bug.php?id=27337 http://dev.mysql.com/doc/refman/5.1/en/news-5-1-18.html http://lists.mysql.com/announce/470 http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html http://osvdb.org/34765 http://secunia.com/advisories/25301 http://secunia.com/advisories/26073 http://secunia.com/advisories/26430 http://secunia.com/advisories/27823 http://secunia.com/advisories/28637 http://secunia.com/advisories/28838 http://secunia& •
CVSS: 2.1EPSS: 0%CPEs: 18EXPL: 3CVE-2007-1420 – MySQL 5.0.x - Single Row SubSelect Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-1420
MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function. MySQL versión 5.x anterior a 5.0.36, permite a los usuarios locales causar una denegación de servicio (bloqueo de base de datos) al realizar subselecciones de la tabla information_schema y utilizar ORDER BY para ordenar un resultado de una sola fila, lo que impide que determinados elementos de la estructura se inicialicen y desencadene una desreferencia de NULL en la función filesort. • https://www.exploit-db.com/exploits/29724 http://bugs.mysql.com/bug.php?id=24630 http://dev.mysql.com/doc/refman/5.0/en/releasenotes-es-5-0-36.html http://secunia.com/advisories/24483 http://secunia.com/advisories/24609 http://secunia.com/advisories/25196 http://secunia.com/advisories/25389 http://secunia.com/advisories/25946 http://secunia.com/advisories/30351 http://security.gentoo.org/glsa/glsa-200705-11.xml http://securityreason.com/securityalert/2413 http:& • CWE-476: NULL Pointer Dereference •