CVSS: 7.5EPSS: 2%CPEs: 34EXPL: 2CVE-2002-1809 – MySQL 3.20.32/3.22.x/3.23.x - Null Root Password Weak Default Configuration
https://notcve.org/view.php?id=CVE-2002-1809
The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database. • https://www.exploit-db.com/exploits/21725 http://archives.neohapsis.com/archives/bugtraq/2002-08/0185.html http://www.iss.net/security_center/static/9902.php http://www.securityfocus.com/bid/5503 •
CVSS: 7.5EPSS: 2%CPEs: 62EXPL: 2CVE-2002-1374 – MySQL 3.23.x/4.0.x - 'COM_CHANGE_USER' Password Length Account
https://notcve.org/view.php?id=CVE-2002-1374
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password. El comando COM_CHANGE_USER en MySQL 3.x anterirores de 3.23.54 y 4.x anteriores a 4.0.5 permite a atacantes remotos ganar privilegios mediante un ataque de fuerza bruta usando una contraseña de un carácter, lo que hace que MySQL compare la contraseña suministrada sólo con el primer carácter de la contraseña real. • https://www.exploit-db.com/exploits/22084 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555 http://marc.info/?l=bugtraq&m=103971644013961&w=2 http://marc.info/?l=bugtraq&m=104004857201968&w=2 http://marc.info/?l=bugtraq&m=104005886114500&w=2 http://security.e-matters.de/advisories/042002.html http://www.debian.org/security/2002/dsa-212 http://www.linuxsecurity.com/advisories/engarde_advisory-2660.html http://www.mandrakesoft.com/security/advisories? •
CVSS: 7.5EPSS: 12%CPEs: 62EXPL: 1CVE-2002-1375 – MySQL 3.23.x/4.0.x - COM_CHANGE_USER Password Memory Corruption
https://notcve.org/view.php?id=CVE-2002-1375
The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response. El comando COM_CHANGE_USER en MySQL 3.x anteriores a 2.23.54 y 4.x anterior a 4.0.6 permite a atacantes remotos ejecutar código arbitrario mediante una respuesta larga. • https://www.exploit-db.com/exploits/22085 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555 http://marc.info/?l=bugtraq&m=103971644013961&w=2 http://marc.info/?l=bugtraq&m=104004857201968&w=2 http://marc.info/?l=bugtraq&m=104005886114500&w=2 http://security.e-matters.de/advisories/042002.html http://www.debian.org/security/2002/dsa-212 http://www.linuxsecurity.com/advisories/engarde_advisory-2660.html http://www.mandrakesoft.com/security/advisories? •
CVSS: 5.0EPSS: 7%CPEs: 47EXPL: 0CVE-2002-1373
https://notcve.org/view.php?id=CVE-2002-1373
Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call. Vulnerabilidad de enteros con signo en el paquete COM_TABLE_DUMP de MySQL 3.23.x anteriores a 3.23.54 permite a atacantes remotos causar una denegación de servicio (caída o cuelge) en mysqld proveyendo a una llamada a memcpy() con enteros negativos grandes. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555 http://marc.info/?l=bugtraq&m=103971644013961&w=2 http://marc.info/?l=bugtraq&m=104004857201968&w=2 http://security.e-matters.de/advisories/042002.html http://www.debian.org/security/2002/dsa-212 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:087 http://www.novell.com/linux/security/advisories/2003_003_mysql.html http://www.redhat.com/support/errata/RHSA-2002-288.html http://www.redhat&# •
CVSS: 7.5EPSS: 1%CPEs: 62EXPL: 0CVE-2002-1376
https://notcve.org/view.php?id=CVE-2002-1376
libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code. La librería de cliente libmysqlclient en MySQL 3.x a 3.23.54 y 4.x a 4.06, no verifica adecuadamente longitudes de campos de ciertas respuestas en las rutinas read_rows o read_one_row, lo que permite a a atacantes remotos causar una denegación de servicio y posiblemente ejecutar código arbitrario. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000555 http://marc.info/?l=bugtraq&m=103971644013961&w=2 http://marc.info/?l=bugtraq&m=104004857201968&w=2 http://marc.info/?l=bugtraq&m=104005886114500&w=2 http://marc.info/? •