p PatchFirst

PatchFirst · Latest vulnerabilities

Databases stack vulnerabilities · Page 42

Vulnerabilities published for Databases in the last 30 days: 82. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Databases

Vulnerabilities: 1414

  1. CVE-2021-2372

    Medium · CVSS 4.4EPSS 3.03%Fix available

    CVE-2021-2372

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mariadb-10.5 mysql-5.5 mysql-5.7 mariadb-10.0 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mariadb-10.1 mariadb-10.3 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 1:10.3.31-0ubuntu0.20.04.1
    • Update to 1:10.5.12-0+deb11u1
    • Update to 5.7.35-0ubuntu0.16.04.1+esm1
    • Update to 5.7.35-0ubuntu0.18.04.1
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2021-2370

    Medium · CVSS 4.9EPSS 2.52%Fix available

    CVE-2021-2370

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2021-2367

    Medium · CVSS 4.9EPSS 2.59%Fix available

    CVE-2021-2367

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2021-2357

    Medium · CVSS 4.9EPSS 2.59%Fix available

    CVE-2021-2357

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2021-2356

    Medium · CVSS 5.9EPSS 2.2%Fix available

    CVE-2021-2356

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2021-2354

    Medium · CVSS 4.9EPSS 2.75%Fix available

    CVE-2021-2354

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2021-2352

    Medium · CVSS 4.9EPSS 3.22%Fix available

    CVE-2021-2352

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2021-2342

    Medium · CVSS 4.9EPSS 2.59%Fix available

    CVE-2021-2342

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 5.7.35-0ubuntu0.16.04.1+esm1
    • Update to 5.7.35-0ubuntu0.18.04.1
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2021-2340

    Low · CVSS 2.7EPSS 2.63%Fix available

    CVE-2021-2340

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2021-2339

    Medium · CVSS 4.9EPSS 2.73%Fix available

    CVE-2021-2339

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0 mysql-8.0Operating systems Databases
    • Update to 8.0.26-0ubuntu0.20.04.2
    • Update to 8.0.26-0ubuntu1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2021-32719

    Low · CVSS 3.1EPSS 1.42%Fix available

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin

    RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.htm

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-serverOperating systems Databases
    • Update to 3.8.3-0ubuntu0.2
    • Update to 3.9.4-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2021-32718

    Low · CVSS 3.1EPSS 1.43%Fix available

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI

    RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring.

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server rabbitmq-serverOperating systems Databases
    • Update to 3.8.3-0ubuntu0.2
    • Update to 3.9.4-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2021-32625

    High · CVSS 7.5EPSS 4.14%Fix available

    Redis vulnerability in STRALGO LCS on 32-bit systems

    Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer, could be exploited using the STRALGO LCS command to corrupt the heap and potentially result with remote code execution. This is a result of an incomplete fix by CVE-2021-29477. The problem is fixed in version 6.2.4 and 6.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the STRALGO LCS command. On 64 bit systems which have the fixes of CVE-2021-29477 (6.2.3 or 6.0.1

    redis redis redis redis redis redisOperating systems Databases
    • Update to 5:6.0.14-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2021-32027

    High · CVSS 8.8EPSS 1.99%Fix available

    CVE-2021-32027

    A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

    postgresql postgresql-13 postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12Operating systems Databases
    • Update to 10.17-0ubuntu0.18.04.1
    • Update to 12.7-0ubuntu0.20.04.1
    • Update to 13.3-1
    • Update to 9.5.25-0ubuntu0.16.04.1+esm1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2021-29478

    High · CVSS 7.5EPSS 3.61%Fix available

    Vulnerability in the COPY command for large intsets

    Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution. Redis 6.0 and earlier are not directly affected by this issue. The problem is fixed in version 6.2.3. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `set-max-intset-entries` configuration parameter. This can be done using ACL to restrict unprivileged users from using the `CONFIG SET` command.

    redis redis redis redisOperating systems Databases
    • Update to 5:6.0.13-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2021-29477

    High · CVSS 7.5EPSS 4%Fix available

    Vulnerability in the STRALGO LCS command

    Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution. The problem is fixed in version 6.2.3 and 6.0.13. An additional workaround to mitigate the problem without patching the redis-server executable is to use ACL configuration to prevent clients from using the `STRALGO LCS` command.

    redis redis redis redisOperating systems Databases
    • Update to 5:6.0.13-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2021-2308

    Low · CVSS 2.7EPSS 0.95%Fix available

    CVE-2021-2308

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Operating systems Databases
    • Update to 8.0.25-0ubuntu0.20.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2021-2307

    Medium · CVSS 6.1EPSS 1.01%Fix available

    CVE-2021-2307

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data as well as unauthorized update, insert or delete access to some of MySQL Server accessible data

    mysql mysql-5.5 mysql-5.7 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-5.7 mysql-8.0Operating systems Databases
    • Update to 5.7.34-0ubuntu0.18.04.1
    • Update to 5.7.35-0ubuntu0.16.04.1+esm1
    • Update to 8.0.25-0ubuntu0.20.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2021-2305

    Medium · CVSS 4.9EPSS 1.19%Fix available

    CVE-2021-2305

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Operating systems Databases
    • Update to 8.0.25-0ubuntu0.20.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2021-2304

    Medium · CVSS 5.5EPSS 1.16%Fix available

    CVE-2021-2304

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:

    mysql mysql-5.5 percona-server-5.6 percona-xtradb-cluster-5.6 mysql-8.0Operating systems Databases
    • Update to 8.0.25-0ubuntu0.20.04.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →