CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 3CVE-2012-5627 – Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass
https://notcve.org/view.php?id=CVE-2012-5627
Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks. Oracle MySQL y MariaDB 5.5.x anteriores a 5.5.29, 5.3.x anteriores a 5.3.12, y 5.2.x anteriores a 5.2.14 no modifican el "salt" durante múltiples ejecuciones del comando change_user en una misma conexión, lo cual facilita a usuarios remotamente autenticados ejecutar ataques de adivinación de contraseña por fuerza bruta. • https://www.exploit-db.com/exploits/38109 http://seclists.org/fulldisclosure/2012/Dec/58 http://seclists.org/fulldisclosure/2012/Dec/83 http://seclists.org/oss-sec/2012/q4/424 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:102 https://bugzilla.redhat.com/show_bug.cgi?id=883719 https://mariadb.atlassian.net/browse/MDEV-3915 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.0EPSS: 88%CPEs: 21EXPL: 2CVE-2013-1861 – MySQL / MariaDB - Geometry Query Denial of Service
https://notcve.org/view.php?id=CVE-2013-1861
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error. MariaDB 5.5.x en versiones anteriores a 5.5.30, 5.3.x en versiones anteriores a 5.3.13, 5.2.x en versiones anteriores a 5.2.15 y 5.1.x en versiones anteriores a 5.1.68 y Oracle MySQL 5.1.69 y versiones anteriores, 5.5.31 y versiones anteriores y 5.6.11 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (caída) a través de una funcionalidad de geometría manipulada que especifica un gran número de puntos, que no es apropiadamente manipulada cuando se procesa la representación binaria de esta funcionalidad, relacionado con un error de cálculo numérico. • https://www.exploit-db.com/exploits/38392 http://lists.askmonty.org/pipermail/commits/2013-March/004371.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2013-10/msg00001.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00024.html http://lists.opensuse.org/opensuse-updates/2013-09/msg00008.html http://seclists.org/oss-sec/2013/q1/671 http://secunia.com/advisories/52639 http://secunia.com/a • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 1%CPEs: 15EXPL: 0CVE-2013-0383 – mysql: unspecified unauthenticated DoS vulnerability related to Server Locking (CPU Jan 2013)
https://notcve.org/view.php?id=CVE-2013-0383
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking. Una vulnerabilidad no especificada en el componente Servidor de Oracle MySQL v5.1.66 y anteriores y v5.5.28 y anteriores, permite a atacantes remotos afectar a la disponibilidad a través de vectores desconocidos relacionados con el bloqueo del servidor. • http://rhn.redhat.com/errata/RHSA-2013-0219.html http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html http://www.ubuntu.com/usn/USN-1703-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16758 https://access.redhat.com/security/cve/CVE-2013-0383 https://bugzilla.redhat.com& •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 0CVE-2013-0368
https://notcve.org/view.php?id=CVE-2013-0368
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. Una vulnerabilidad no especificada en el componente Servidor de Oracle MySQL v5.5.28 y anteriores permite a usuarios remotos autenticados afectar a la disponibilidad a través de vectores desconocidos relacionados con InnoDB. • http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html http://www.ubuntu.com/usn/USN-1703-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17255 •
CVSS: 4.0EPSS: 0%CPEs: 15EXPL: 0CVE-2012-0572 – mysql: unspecified DoS vulnerability related to InnoDB (CPU Jan 2013)
https://notcve.org/view.php?id=CVE-2012-0572
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. Vulnerabilidad no especificada en el componente Server en Oracle MySQL v5.1.66 y anteriores y v5.5.28 y anteriores permite a usuarios remotos autenticados afectar a la disponibilidad a través de vectores desconocidos relacionados con InnoDB. • http://rhn.redhat.com/errata/RHSA-2013-0219.html http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html http://www.ubuntu.com/usn/USN-1703-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16792 https://access.redhat.com/security/cve/CVE-2012-0572 https://bugzilla.redhat.com& •