95 matches found
CVE-2020-14027
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...
Code injection
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...
CVE-2020-14027
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...
CVE-2020-14027
CVE-2020-14027 affects Ozeki NG SMS Gateway up to version 4.17.6, where database connection strings accept custom unsafe arguments (e.g., ENABLE_LOCAL_INFILE). This enables MySQL LOAD DATA LOCAL INFILE attacks via rogue servers. The connected sources confirm the vulnerable component as the databa...
Denial Of Service (DoS)
mysql is vulnerable to denial of service DoS. The vulnerability exists as a flaw in the way MySQL handled LOAD DATA INFILE requests allowed MySQL to send OK packets even when there were errors...
The vulnerability of the LOAD DATA LOCAL INFILE component in the mysql (mysqljs) Node.js software module allows a hacker to gain unauthorized access to protected information.
The vulnerability of the LOAD DATA LOCAL INFILE component in the mysql mysqljs Node.js software platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
Iteris Vantage Velocity Field Unit Cross-Site Scripting Vulnerability
The Iteris Vantage Velocity Field Unit is a road monitoring field unit from Iteris USA. A cross-site scripting vulnerability exists in all parameters of the Start Data Viewer function of the /cgi-bin/loaddata.py script in the Iteris Vantage Velocity Field Unit version 2.4.2. The vulnerability ste...
Infogram: LFI through the MySQL connection
Hello team! I've found a way to read Infogram's server local files through the MySQL connection. The problem is that you're using the LOAD DATA LOCAL feature with your MySQL client. This how an attacker can easily send server's local files to her/his database. I've successfully readed the...
UBUNTU-CVE-2018-14669
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server...
PT-2019-9040 · Clickhouse · Clickhouse Mysql Client
Name of the Vulnerable Software and Affected Versions: ClickHouse MySQL client versions prior to 1.1.54390 Description: The issue concerns the "LOAD DATA LOCAL INFILE" functionality in the ClickHouse MySQL client, which was enabled and allowed a malicious MySQL database to read arbitrary files fr...
DEBIAN-CVE-2019-14939
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
UBUNTU-CVE-2019-14939
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
CVE-2019-14939
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
Buffer overflow
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
CVE-2019-14939
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)
Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results ar...
hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)
Microprocessors use a ‘load port’ subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPU’s pipelines. Stale load operations results ar...
phpMyAdmin -- File disclosure and SQL injection
The phpMyAdmin development team reports: Summary Arbitrary file read vulnerability Description When AllowArbitraryServer configuration set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. phpMyadmin attempts to block...
CVE-2018-14669
ClickHouse MySQL client had “LOAD DATA LOCAL INFILE” functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server. Andrey Krasichkov and Evgeny Sidorov of Yandex Information Security Team...
Internet Bug Bounty: Incorrect logic in MySQL & MariaDB protocol leads to remote SSRF/Remote file read
Overview Wrong logic in realization of LOAD DATA LOCAL INFILE function leads to remote attacker can read files from server. Problem exists in many MySQL-drivers and frameworks, on many programming languages, like Python, Java, PHP etc. For exploitation this vulnerability we need to connect to our...