361 matches found
Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-897-1)
It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This update alters table creation behaviour by disallowing the use of the MySQL...
CVE-2008-7247
sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a 1 DATA DIRECTORY or 2...
CVE-2008-7247
CVE-2008-7247 affects MySQL in 5.0.x (up to 5.0.88), 5.1.x (up to 5.1.41), and 6.0 (before 6.0.9-alpha). The issue occurs when the data home directory contains a symlink to a different filesystem; remote authenticated users can bypass access restrictions by issuing CREATE TABLE with a (1) DATA DI...
MySQL < 5.1.41 Multiple Vulnerabilities
Binary data 801137.prm...
Oracle MySQL < 5.1.41 Multiple Vulnerabilities
Binary data 5240.prm...
webshell mention the weight point directory summary-vulnerability warning-the black bar safety net
C:\Documents and Settings\All Users\Start Menu\Programs\ --'look here, can jump, and we from here can get a lot of useful information such as Serv-U path. C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\ --‘see if you can jump to this directory, if the line that is the...
CVE-2009-3541
PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the DataDirectory parameter...
SuSE9 Security Update : MySQL (YOU Patch Number 12175)
The database server mySQL was updated to fix two security problems : - MySQL allowed local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified 1 DATA DIRECTORY or 2 INDEX DIRECTORY arguments that are within the MySQL home data directory, which can poin...
mysql: privilege escalation via DATA/INDEX DIRECTORY directives
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified 1 DATA DIRECTORY or 2 INDEX DIRECTORY arguments that are within the MySQL home data directory,...
Fedora 11 : znc-0.072-3.fc11 (2009-7952)
No CVE yet, one has been requested. Upgrade to 0.072 of ZNC, fixes security issue in bug 513152 An users data directory traversal flaw was found in the way ZNC used to handle file upload requests via Direct Client Connection DCC /dcc SEND messages. A remote IRC user could issue a /dcc SEND messag...
mysql: incomplete upstream fix for CVE-2008-2079
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified 1 DATA DIRECTORY or 2 INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time a...
Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-671-1
Ubuntu Update for Linux kernel vulnerabilities USN-671-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6711.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for mysql-dfsg-5.0 vulnerabilities USN-671-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...
Ubuntu: Security Advisory (USN-671-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
TxtBlog (index.php m) Local File Inclusion Vulnerability
Exploit for unknown platform in category web applications ======================================================== TxtBlog index.php m Local File Inclusion Vulnerability ======================================================== ============================================================ TxtBlog...
USN-671-1: MySQL vulnerabilities
It was discovered that MySQL could be made to overwrite existing table files in the data directory. An authenticated user could use the DATA DIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks. This update alters table creation behaviour by disallowing the use of the MySQL...
GLSA-200809-04 : MySQL: Privilege bypass
The remote host is affected by the vulnerability described in GLSA-200809-04 MySQL: Privilege bypass Sergei Golubchik reported that MySQL imposes no restrictions on the specification of 'DATA DIRECTORY' or 'INDEX DIRECTORY' in SQL 'CREATE TABLE' statements. Impact : An authenticated remote attack...
MySQL: Privilege bypass
Background MySQL is a popular multi-threaded, multi-user SQL server. Description Sergei Golubchik reported that MySQL imposes no restrictions on the specification of "DATA DIRECTORY" or "INDEX DIRECTORY" in SQL "CREATE TABLE" statements. Impact An authenticated remote attacker could create MyISAM...
mysql: privilege escalation via DATA/INDEX DIRECTORY directives
MySQL 4.1.x before 4.1.24, 5.0.x before 5.0.60, 5.1.x before 5.1.24, and 6.0.x before 6.0.5 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified 1 DATA DIRECTORY or 2 INDEX DIRECTORY arguments that are within the MySQL home data directory,...
Moderate: Red Hat Security Advisory: mysql security, bug fix, and enhancement update
Updated mysql packages that fix various security issues, several bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database...
mysql -- MyISAM table privileges security bypass vulnerability for symlinked paths
MySQL Team reports: Additional corrections were made for the symlink-related privilege problem originally addressed. The original fix did not correctly handle the data directory pathname if it contained symlinked directories in its path, and the check was made only at table-creation time, not at...