p PatchFirst

PatchFirst · Latest vulnerabilities

Databases stack vulnerabilities · Page 30

Vulnerabilities published for Databases in the last 30 days: 81. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Databases

Vulnerabilities: 1413

  1. CVE-2023-21940

    Medium · CVSS 4.4EPSS 1.29%Fix available

    CVE-2023-21940

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-21935

    Medium · CVSS 4.9EPSS 1.39%Fix available

    CVE-2023-21935

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-21933

    Medium · CVSS 4.9EPSS 1.4%Fix available

    CVE-2023-21933

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2023-21929

    Medium · CVSS 5.5EPSS 1.28%Fix available

    CVE-2023-21929

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2023-21920

    Medium · CVSS 4.9EPSS 1.47%Fix available

    CVE-2023-21920

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2023-21919

    Medium · CVSS 4.9EPSS 1.46%Fix available

    CVE-2023-21919

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2023-21917

    Medium · CVSS 4.9EPSS 1.12%Fix available

    CVE-2023-21917

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.31-0ubuntu0.20.04.1
    • Update to 8.0.31-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2023-21913

    Medium · CVSS 4.9EPSS 1.12%Fix available

    CVE-2023-21913

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2023-21912

    High · CVSS 7.5EPSS 1.17%Fix available

    CVE-2023-21912

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 5.7.42-0ubuntu0.16.04.1+esm1
    • Update to 5.7.42-0ubuntu0.18.04.1
    • Update to 8.0.31-0ubuntu0.20.04.1
    • Update to 8.0.31-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2023-21911

    Medium · CVSS 4.9EPSS 1.37%Fix available

    CVE-2023-21911

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.33-0ubuntu0.20.04.1
    • Update to 8.0.33-0ubuntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2023-28425

    Medium · CVSS 5.5EPSS 58.53%Fix available

    Specially crafted MSETNX command can lead to denial-of-service

    Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.

    redis redis redis redisOperating systems Databases
    • Update to 5:7.0.10-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2022-41862

    Low · CVSS 3.7EPSS 0.62%Fix available

    CVE-2022-41862

    In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

    postgresql postgresql-15 postgresql-12 postgresql-14Operating systems Databases
    • Update to 12.14-0ubuntu0.20.04.1
    • Update to 14.7-0ubuntu0.22.04.1
    • Update to 15.2-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2023-25155

    Medium · CVSS 5.5EPSS 0.9%Fix available

    Integer Overflow in several Redis commands can lead to denial of service.

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.

    redis redis redis redis redis redis redis redis redisOperating systems Databases
    • Update to 2:2.8.4-2ubuntu0.2+esm3
    • Update to 2:3.0.6-1ubuntu0.4+esm2
    • Update to 5:4.0.9-1ubuntu0.2+esm4
    • Update to 5:5.0.7-2ubuntu0.1+esm2
    • Update to 5:6.0.16-1ubuntu1+esm1
    • Update to 5:7.0.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2022-36021

    Medium · CVSS 5.5EPSS 59.77%Fix available

    Redis string pattern matching can be abused to achieve Denial of Service

    Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

    redis redis redis redis redis redis redis redis redisOperating systems Databases
    • Update to 2:2.8.4-2ubuntu0.2+esm3
    • Update to 2:3.0.6-1ubuntu0.4+esm2
    • Update to 5:4.0.9-1ubuntu0.2+esm4
    • Update to 5:5.0.7-2ubuntu0.1+esm2
    • Update to 5:6.0.16-1ubuntu1+esm1
    • Update to 5:7.0.9-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2022-35977

    Medium · CVSS 5.5EPSS 13.45%Fix available

    Integer overflow in certain command arguments can drive Redis to OOM panic

    Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    redis redis redis redis redis redis redis redis redisOperating systems Databases
    • Update to 2:2.8.4-2ubuntu0.2+esm3
    • Update to 2:3.0.6-1ubuntu0.4+esm2
    • Update to 5:4.0.9-1ubuntu0.2+esm4
    • Update to 5:5.0.7-2ubuntu0.1+esm2
    • Update to 5:6.0.16-1ubuntu1+esm1
    • Update to 5:7.0.8-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2023-22458

    Medium · CVSS 5.5EPSS 71.98%Fix available

    Integer overflow in multiple Redis commands can lead to denial-of-service

    Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    redis redis redis redisOperating systems Databases
    • Update to 5:7.0.8-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2023-21887

    Medium · CVSS 4.9EPSS 43.4%Fix available

    CVE-2023-21887

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2023-21883

    Medium · CVSS 4.9EPSS 0.88%Fix available

    CVE-2023-21883

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2023-21882

    Low · CVSS 2.7EPSS 0.66%Fix available

    CVE-2023-21882

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2023-21881

    Medium · CVSS 4.9EPSS 0.88%Fix available

    CVE-2023-21881

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.32-0buntu0.20.04.1
    • Update to 8.0.32-0buntu0.22.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →