CVSS: 7.5EPSS: 96%CPEs: 61EXPL: 8CVE-2012-2122 – MySQL - Authentication Bypass
https://notcve.org/view.php?id=CVE-2012-2122
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value. sql/password.c en Oracle MySQL 5.1.x anterior a 5.1.63, 5.5.x anterior a 5.5.24, y 5.6.x anterior a 5.6.6, y MariaDB 5.1.x anterior a 5.1.62, 5.2.x anterior a 5.2.12, 5.3.x anterior a 5.3.6, y 5.5.x anterior a 5.5.23, cuando se ejecuta en determinados entornos con determinadas implementaciones de la función memcmp, permite que atacantes remotos eviten la autenticación utilizando repetidamente la misma contraseña incorrecta, lo que eventualmente provoca una comparación de token con resultado de éxito en una variable de retorno no validada • https://www.exploit-db.com/exploits/19092 https://github.com/zhangkaibin0921/CVE-2012-2122 https://github.com/Avinza/CVE-2012-2122-scanner https://github.com/cyberharsh/Oracle-mysql-CVE-2012-2122 http://bugs.mysql.com/bug.php?id=64884 http://kb.askmonty.org/en/mariadb-5162-release-notes http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00007.html http://seclists.org/oss-sec/2012/q2/493 http://secunia.com/advisories/49417 http://secunia.com/advisories/53372 • CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1697
https://notcve.org/view.php?id=CVE-2012-1697
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition. Vulnerabilidad no especificada en el componente de servidor MySQL en Oracle MySQL v5.5.21 y anteriores permite a usuarios remotos autenticados afectar a la disponibilidad a través de vectores desconocidos relacionados con la partición. • http://secunia.com/advisories/48890 http://secunia.com/advisories/49179 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.securityfocus.com/bid/53064 http://www.securitytracker.com/id?1026934 •
CVSS: 4.0EPSS: 0%CPEs: 8EXPL: 0CVE-2012-1688 – mysql: unspecified DoS vulnerability related to DML (CPU Apr 2012)
https://notcve.org/view.php?id=CVE-2012-1688
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability, related to Server DML. Vulnerabilidad no especificada en el componente MySQL Server en Oracle MySQL v5.1.61 y anteriores, y v5.5.21 y anteriores, que permite a usuarios remotos autenticados afectar la disponibilidad, relacionado con Server DML. • http://rhn.redhat.com/errata/RHSA-2012-1462.html http://secunia.com/advisories/48890 http://secunia.com/advisories/49179 http://secunia.com/advisories/51309 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.securityfocus.com/bid/53067 http://www.securitytracker.com/id?1026934 https://access.redh •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2012-1703 – mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Apr 2012)
https://notcve.org/view.php?id=CVE-2012-1703
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690. Vulnerabilidad no especificada en el componente MySQL Server en Oracle MySQL 5.1.61 y versiones anteriores y 5.5.21 y versiones anteriores, permite a usuarios remotos autenticados afectar la disponibilidad a través de vectores desconocidos relacionados con Server Optimizer, una vulnerabilidad diferente a CVE-2012-1690. • http://rhn.redhat.com/errata/RHSA-2012-1462.html http://secunia.com/advisories/48890 http://secunia.com/advisories/49179 http://secunia.com/advisories/51309 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.securityfocus.com/bid/53058 http://www.securitytracker.com/id?1026934 https://access.redh •
CVSS: 4.0EPSS: 0%CPEs: 89EXPL: 0CVE-2012-0583 – mysql: unspecified DoS vulnerability in MyISAM (Oracle CPU April 2012)
https://notcve.org/view.php?id=CVE-2012-0583
Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.60 and earlier, and 5.5.19 and earlier, allows remote authenticated users to affect availability, related to MyISAM. Vulnerabilidad no especificada en el componente MySQL Server en Oracle MySQL v5.1.60 y anteriores, y v5.5.19 y anteriores, que permite a usuarios remotos autenticados afectar la disponibilidad, relacionado con MyISAM. • http://secunia.com/advisories/48890 http://secunia.com/advisories/49179 http://secunia.com/advisories/53372 http://security.gentoo.org/glsa/glsa-201308-06.xml http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.securityfocus.com/bid/53061 http://www.securitytracker.com/id?1026934 https://access.redhat.com/security/cve/CVE-2012-0583 https://bugzilla.redhat.com/show_bug.cgi?id=814282 •