p PatchFirst

PatchFirst · Latest vulnerabilities

Databases stack vulnerabilities · Page 29

Vulnerabilities published for Databases in the last 30 days: 81. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Databases

Vulnerabilities: 1413

  1. CVE-2023-22005

    Medium · CVSS 4.4EPSS 1.29%Fix available

    CVE-2023-22005

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.34-0ubuntu0.20.04.1
    • Update to 8.0.34-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-21950

    Medium · CVSS 4.9EPSS 1%Fix available

    CVE-2023-21950

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Operating systems Databases
    • Update to 8.0.28-0ubuntu0.20.04.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2022-24834

    High · CVSS 7EPSS 41.41%Fix available

    Heap overflow issue with the Lua cjson library used by Redis

    Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20.

    redis redis redis redis redis redis lua-cjson lua-cjson redis lua-cjson redis lua-cjsonOperating systems Databases
    • Update to 2.1.0+dfsg-2.1ubuntu0.20.04.1~esm2
    • Update to 2.1.0+dfsg-2.1ubuntu0.22.04.1~esm2
    • Update to 2:2.8.4-2ubuntu0.2+esm3
    • Update to 2:3.0.6-1ubuntu0.4+esm2
    • Update to 5:4.0.9-1ubuntu0.2+esm4
    • Update to 5:5.0.7-2ubuntu0.1+esm2
    • Update to 5:6.0.16-1ubuntu1+esm1
    • Update to 5:7.0.12-1
    • Update to 5:7.0.15-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2023-36824

    High · CVSS 7.4EPSS 77.42%Fix available

    Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

    Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12.

    redis redis redis redisOperating systems Databases
    • Update to 5:7.0.12-1
    • Update to 5:7.0.15-1~deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2023-2455

    Medium · CVSS 5.4EPSS 0.7%Fix available

    CVE-2023-2455

    Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Operating systems Databases
    • Update to 10.23-0ubuntu0.18.04.2
    • Update to 12.15-0ubuntu0.20.04.1
    • Update to 14.8-0ubuntu0.22.04.1
    • Update to 15.3-0+deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2023-2454

    High · CVSS 7.2EPSS 1.2%Fix available

    CVE-2023-2454

    schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

    postgresql postgresql-15 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 postgresql-14Operating systems Databases
    • Update to 10.23-0ubuntu0.18.04.2
    • Update to 12.15-0ubuntu0.20.04.1
    • Update to 14.8-0ubuntu0.22.04.1
    • Update to 15.3-0+deb12u1
    • Update to 9.5.25-0ubuntu0.16.04.1+esm4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2023-28856

    Medium · CVSS 5.5EPSS 1.26%Fix available

    `HINCRBYFLOAT` can be used to crash a redis-server process

    Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.

    redis redis redis redis redis redis redis redis redisOperating systems Databases
    • Update to 2:2.8.4-2ubuntu0.2+esm3
    • Update to 2:3.0.6-1ubuntu0.4+esm2
    • Update to 5:4.0.9-1ubuntu0.2+esm4
    • Update to 5:5.0.7-2ubuntu0.1+esm2
    • Update to 5:6.0.16-1ubuntu1+esm1
    • Update to 5:7.0.11-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2023-21982

    Medium · CVSS 4.9EPSS 1.13%Fix available

    CVE-2023-21982

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2023-21980

    High · CVSS 7.1EPSS 0.83%Fix available

    CVE-2023-21980

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 5.7.42-0ubuntu0.16.04.1+esm1
    • Update to 5.7.42-0ubuntu0.18.04.1
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2023-21977

    Medium · CVSS 4.9EPSS 1.13%Fix available

    CVE-2023-21977

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2023-21976

    Medium · CVSS 4.9EPSS 1.14%Fix available

    CVE-2023-21976

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2023-21972

    Medium · CVSS 4.9EPSS 1.14%Fix available

    CVE-2023-21972

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2023-21966

    Medium · CVSS 4.9EPSS 1.12%Fix available

    CVE-2023-21966

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2023-21963

    Low · CVSS 2.7EPSS 1%Fix available

    CVE-2023-21963

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 5.7.41-0ubuntu0.16.04.1+esm1
    • Update to 5.7.41-0ubuntu0.18.04.1
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2023-21962

    Medium · CVSS 4.9EPSS 1.39%Fix available

    CVE-2023-21962

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2023-21955

    Medium · CVSS 4.9EPSS 1.39%Fix available

    CVE-2023-21955

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2023-21953

    Medium · CVSS 4.9EPSS 1.46%Fix available

    CVE-2023-21953

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2023-21947

    Medium · CVSS 4.4EPSS 1.37%Fix available

    CVE-2023-21947

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2023-21946

    Medium · CVSS 6.5EPSS 1.5%Fix available

    CVE-2023-21946

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2023-21945

    Medium · CVSS 4.9EPSS 1.4%Fix available

    CVE-2023-21945

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →