CVE-2024-21507

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key...

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js...

12g (>=0.0.27, <=1.0.1), 1st-project (1.0.2) +3157 more potentially affected by CVE-2024-21509 via mysql2 (>=0.8.21, <=3.9.3)

mysql2 NPM version =0.8.21, =0.0.27, =0.0.2, =0.0.1, =15.0.0, =0.0.1, =0.7.2, =1.0.40, =0.0.2, =0.0.24 - @a-a-game-studio/aa-mq.core 0.0.2 and more Source cves: CVE-2024-21509 Source advisory: MEND:CVE-2024-21509...

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js...

CVE-2024-21509

The CVE-2024-21509 vulnerability affects the mysql2 package prior to version 3.9.4, as described across multiple sources. The root cause is Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser....

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js...

CVE-2024-21509

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js...

CVE-2024-21509: Improperly Controlled Modification of Object Prototype Attributes

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and binaryparser.js...

MySQL2 security vulnerabilities

MySQL2 is a MySQL client for Node.js by the individual developer Andrey Sidorov. A security vulnerability exists in MySQL2 versions prior to 3.9.4 that stems from improper cleaning of user input...

MySQL2 security vulnerabilities

MySQL2 is a MySQL client for Node.js by the individual developer Andrey Sidorov. A security vulnerability exists in MySQL2 versions prior to 3.9.3, which stems from incorrect input validation via the keyFromFields function, leading to cache poisoning...

PT-2024-18922

Name of the Vulnerable Software and Affected Versions mysql2 versions prior to 3.9.3 Description The issue is related to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted ke...

CVE-2024-21507: Improper Input Validation

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key...

PT-2024-18923

Name of the Vulnerable Software and Affected Versions mysql2 versions prior to 3.9.4 Description The issue is related to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text parser.js and binary parser.js. Recommendations...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +139 more potentially affected by CVE-2024-21507 via mysql2 (>=3.0.0-rc.1, <=3.9.2)

mysql2 NPM version =3.0.0-rc.1, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21507 Source advisory: SNYK:JS-MYSQL2-6591300...

Use of Web Browser Cache Containing Sensitive Information

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +141 more potentially affected by CVE-2024-21508 via mysql2 (>=3.0.0-rc.1, <=3.9.3)

mysql2 NPM version =3.0.0-rc.1, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21508 Source advisory: SNYK:JS-MYSQL2-6591085...

Remote Code Execution (RCE)

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Remote Code Execution RCE via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values. PoC js sql:SELECT...

@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +141 more potentially affected by CVE-2024-21509 via mysql2 (>=3.0.0-rc.1, <=3.9.3)

mysql2 NPM version =3.0.0-rc.1, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21509 Source advisory: SNYK:JS-MYSQL2-6591084...

Prototype Poisoning

Overview mysql2 is a mostly API compatible with mysqljs and supports majority of features. Affected versions of this package are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in textparser.js and...

3.1 bug fix and enhancement update

An update is available for rubygem-mysql2, rubygem-pg, rubygem-abrt, ruby. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in...