p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila Bases de datos · Página 29

Vulnerabilidades publicadas para Bases de datos en los últimos 30 días: 81. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Bases de datos

Vulnerabilidades: 1413

  1. CVE-2023-22005

    Media · CVSS 4.4EPSS 1,29%Corrección disponible

    CVE-2023-22005

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.34-0ubuntu0.20.04.1
    • Actualiza a 8.0.34-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2023-21950

    Media · CVSS 4.9EPSS 1%Corrección disponible

    CVE-2023-21950

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.28-0ubuntu0.20.04.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2022-24834

    Alta · CVSS 7EPSS 41,41%Corrección disponible

    Heap overflow issue with the Lua cjson library used by Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

    redis redis redis redis redis redis lua-cjson lua-cjson redis lua-cjson redis lua-cjsonSistemas operativos Bases de datos
    • Actualiza a 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2
    • Actualiza a 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2
    • Actualiza a 2:2.8.4-2ubuntu0.2+esm3
    • Actualiza a 2:3.0.6-1ubuntu0.4+esm2
    • Actualiza a 5:4.0.9-1ubuntu0.2+esm4
    • Actualiza a 5:5.0.7-2ubuntu0.1+esm2
    • Actualiza a 5:6.0.16-1ubuntu1+esm1
    • Actualiza a 5:7.0.12-1
    • Actualiza a 5:7.0.15-1~deb12u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2023-36824

    Alta · CVSS 7.4EPSS 77,42%Corrección disponible

    Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

    Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.

    redis redis redis redisSistemas operativos Bases de datos
    • Actualiza a 5:7.0.12-1
    • Actualiza a 5:7.0.15-1~deb12u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2023-2455

    Media · CVSS 5.4EPSS 0,7%Corrección disponible

    CVE-2023-2455

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Sistemas operativos Bases de datos
    • Actualiza a 10.23-0ubuntu0.18.04.2
    • Actualiza a 12.15-0ubuntu0.20.04.1
    • Actualiza a 14.8-0ubuntu0.22.04.1
    • Actualiza a 15.3-0+deb12u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2023-2454

    Alta · CVSS 7.2EPSS 1,2%Corrección disponible

    CVE-2023-2454

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Sistemas operativos Bases de datos
    • Actualiza a 10.23-0ubuntu0.18.04.2
    • Actualiza a 12.15-0ubuntu0.20.04.1
    • Actualiza a 14.8-0ubuntu0.22.04.1
    • Actualiza a 15.3-0+deb12u1
    • Actualiza a 9.5.25-0ubuntu0.16.04.1+esm4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2023-28856

    Media · CVSS 5.5EPSS 1,26%Corrección disponible

    `HINCRBYFLOAT` can be used to crash a redis-server process

    Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

    redis redis redis redis redis redis redis redis redisSistemas operativos Bases de datos
    • Actualiza a 2:2.8.4-2ubuntu0.2+esm3
    • Actualiza a 2:3.0.6-1ubuntu0.4+esm2
    • Actualiza a 5:4.0.9-1ubuntu0.2+esm4
    • Actualiza a 5:5.0.7-2ubuntu0.1+esm2
    • Actualiza a 5:6.0.16-1ubuntu1+esm1
    • Actualiza a 5:7.0.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2023-21982

    Media · CVSS 4.9EPSS 1,13%Corrección disponible

    CVE-2023-21982

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2023-21980

    Alta · CVSS 7.1EPSS 0,83%Corrección disponible

    CVE-2023-21980

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 5.7.42-0ubuntu0.16.04.1+esm1
    • Actualiza a 5.7.42-0ubuntu0.18.04.1
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2023-21977

    Media · CVSS 4.9EPSS 1,13%Corrección disponible

    CVE-2023-21977

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2023-21976

    Media · CVSS 4.9EPSS 1,14%Corrección disponible

    CVE-2023-21976

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2023-21972

    Media · CVSS 4.9EPSS 1,14%Corrección disponible

    CVE-2023-21972

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2023-21966

    Media · CVSS 4.9EPSS 1,12%Corrección disponible

    CVE-2023-21966

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2023-21963

    Baja · CVSS 2.7EPSS 1%Corrección disponible

    CVE-2023-21963

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 5.7.41-0ubuntu0.16.04.1+esm1
    • Actualiza a 5.7.41-0ubuntu0.18.04.1
    • Actualiza a 8.0.32-0buntu0.20.04.1
    • Actualiza a 8.0.32-0buntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2023-21962

    Media · CVSS 4.9EPSS 1,39%Corrección disponible

    CVE-2023-21962

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2023-21955

    Media · CVSS 4.9EPSS 1,39%Corrección disponible

    CVE-2023-21955

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2023-21953

    Media · CVSS 4.9EPSS 1,46%Corrección disponible

    CVE-2023-21953

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2023-21947

    Media · CVSS 4.4EPSS 1,37%Corrección disponible

    CVE-2023-21947

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2023-21946

    Media · CVSS 6.5EPSS 1,5%Corrección disponible

    CVE-2023-21946

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2023-21945

    Media · CVSS 4.9EPSS 1,4%Corrección disponible

    CVE-2023-21945

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Sistemas operativos Bases de datos
    • Actualiza a 8.0.33-0ubuntu0.20.04.1
    • Actualiza a 8.0.33-0ubuntu0.22.04.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →