CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

MySQL Server DoS

The vulnerability of the MySQL Server database management system component lies in its unlimited distribution of resources. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

MySQL Server DoS

The vulnerability of the MySQL Server component relates to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

MySQL InnoDB DoS

The vulnerability of the InnoDB component in the MySQL Database Management System is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a hacker to cause service interruptions...

MySQL MariaDB Information Disclosure

The vulnerability of MySQL and MariaDB database management systems is related to the exposure of information. Exploiting this vulnerability allows a malicious actor to gain access to confidential data...

MySQL InnoDB Data Access DoS

The vulnerability of the InnoDB component in the MySQL Database Management System is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to gain access to data or cause service failures...

Arbitrary Code Injection

Neuron is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation in the MySQLSelectTool that fails to block file-writing SQL constructs, which allows an attacker to bypass read-only restrictions and write arbitrary files to the database server...

Arbitrary SQL Execution

Neuron is vulnerable to arbitrary SQL execution. The vulnerability is due to the MySQLWriteTool executing caller‑provided SQL using PDO::prepare and execute without semantic restrictions, where an attacker can inject destructive statements such as DROP TABLE, TRUNCATE, DELETE, or ALTER via...

Deserialization Of Untrusted Data

Dataease is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to improper validation of JDBC connection parameters in the MysqlConfiguration class, which allows an attacker to connect to a malicious MySQL server and execute arbitrary system commands through deserialization...

Remote Code Execution (RCE)

MySQL Connector/J is vulnerable to Remote Code Execution RCE. The vulnerability is due to an unspecified flaw in Connector/J that allows an unauthenticated attacker with network access to compromise the connector through user interaction, potentially resulting in complete takeover of the affected...

Oracle Linux 8 : mysql:8.0 (ELSA-2025-23134)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23134 advisory. mecab mecab-ipadic mysql 8.0.44-1 - Rebase to MySQL 8.0.44 Tenable has extracted the preceding description block directly from the Oracle Linux securi...

Oracle Linux 9 : mysql (ELSA-2025-23109)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-23109 advisory. 8.0.44-1 - Rebase to MySQL 8.0.44 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookier. Vulnerabilities include an attacker is able to brute force something that was supposed to be random, ...

RHSA-2025:23137 Red Hat Security Advisory: mysql:8.4 security update

Bulletin has no description...

RHSA-2025:23134 Red Hat Security Advisory: mysql:8.0 security update

Bulletin has no description...

RHSA-2025:23111 Red Hat Security Advisory: mysql:8.4 security update

Bulletin has no description...

RHSA-2025:23109 Red Hat Security Advisory: mysql security update

Bulletin has no description...

RLSA-2025:23008 Moderate: mysql8.4 security update

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes: mysql: DM...

mysql8.4 security update

An update is available for mysql8.4. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is a multi-user, multi-threaded SQL database server. MySQL is a...