| CVE-2004-0836 | CRITIQUE10.0 | Buffer overflow in the mysql_real_connect function in MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows remote DNS servers to cause a denial of service and possibly execute arbitrary code via a DNS response with a large address length (h_length). | 03/11/2004 |
| CVE-2004-0835 | ÉLEVÉE7.5 | MySQL 3.x before 3.23.59, 4.x before 4.0.19, 4.1.x before 4.1.2, and 5.x before 5.0.1, checks the CREATE/INSERT rights of the original table instead of the target table in an ALTER TABLE RENAME operation, which could allow attackers to conduct unauthorized activities. | 03/11/2004 |
| CVE-2004-0457 | MOYENNE4.6 | The mysqlhotcopy script in mysql 4.0.20 and earlier, when using the scp method from the mysql-server package, allows local users to overwrite arbitrary files via a symlink attack on temporary files. | 28/09/2004 |
| CVE-2004-0388 | FAIBLE2.1 | The mysqld_multi script in MySQL allows local users to overwrite arbitrary files via a symlink attack. | 01/06/2004 |
| CVE-2004-0381 | FAIBLE2.1 | mysqlbug in MySQL allows local users to overwrite arbitrary files via a symlink attack on the failed-mysql-bugreport temporary file. | 04/05/2004 |
| CVE-2003-1480 | MOYENNE4.3 | MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute force methods. | 31/12/2003 |
| CVE-2003-1331 | MOYENNE4.0 | Stack-based buffer overflow in the mysql_real_connect function in the MySql client library (libmysqlclient) 4.0.13 and earlier allows local users to execute arbitrary code via a long socket name, a different vulnerability than CVE-2001-1453. | 31/12/2003 |
| CVE-2003-0780 | CRITIQUE9.0 | Buffer overflow in get_salt_from_password from sql_acl.cc for MySQL 4.0.14 and earlier, and 3.23.x, allows attackers with ALTER TABLE privileges to execute arbitrary code via a long Password field. | 22/09/2003 |
| CVE-2003-0150 | CRITIQUE9.0 | MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf. | 24/03/2003 |
| CVE-2003-0073 | MOYENNE5.0 | Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user. | 19/02/2003 |
| CVE-2002-1923 | ÉLEVÉE7.5 | The default configuration in MySQL 3.20.32 through 3.23.52, when running on Windows, does not have logging enabled, which could allow remote attackers to conduct activities without detection. | 31/12/2002 |
| CVE-2002-1921 | ÉLEVÉE7.5 | The default configuration of MySQL 3.20.32 through 3.23.52, when running on Windows, does set the bind address to the loopback interface, which allows remote attackers to connect to the database. | 31/12/2002 |
| CVE-2002-1809 | ÉLEVÉE7.5 | The default configuration of the Windows binary release of MySQL 3.23.2 through 3.23.52 has a NULL root password, which could allow remote attackers to gain unauthorized root access to the MySQL database. | 31/12/2002 |
| CVE-2002-1376 | ÉLEVÉE7.5 | libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code. | 23/12/2002 |
| CVE-2002-1375 | ÉLEVÉE7.5 | The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x to 4.0.6, allows remote attackers to execute arbitrary code via a long response. | 23/12/2002 |
| CVE-2002-1374 | ÉLEVÉE7.5 | The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password. | 23/12/2002 |
| CVE-2002-1373 | MOYENNE5.0 | Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call. | 23/12/2002 |
| CVE-2002-0969 | ÉLEVÉE7.8 | Buffer overflow in MySQL daemon (mysqld) before 3.23.50, and 4.0 beta before 4.02, on the Win32 platform, allows local users to execute arbitrary code via a long "datadir" parameter in the my.ini initialization file, whose permissions on Windows allow Full Control to the Everyone group. | 11/10/2002 |
| CVE-2001-1255 | MOYENNE4.6 | WinMySQLadmin 1.1 stores the MySQL password in plain text in the my.ini file, which allows local users to obtain unathorized access the MySQL database. | 02/10/2001 |
| CVE-2001-0407 | MOYENNE4.6 | Directory traversal vulnerability in MySQL before 3.23.36 allows local users to modify arbitrary files and gain privileges by creating a database whose name starts with .. (dot dot). | 27/06/2001 |