CVE-2019-17571

CVE-2019-17571 affects the Apache Log4j 1.x SocketServer: it deserializes serialized log events from untrusted network input without proper whitelisting, enabling remote code execution when combined with a deserialization gadget. Affected are Log4j 1.2 up to 1.2.17; exploitation hinges on receivi...

CVE-2019-1559

OpenSSL vulnerability CVE-2019-1559 describes a padding-oracle weakness where, if an application encounters a fatal protocol error and then calls SSL_shutdown() twice (to send close_notify and to receive one), the server may respond differently to a 0-byte record with invalid padding versus inval...

CVE-2019-7317

CVE-2019-7317 is a use-after-free involving png_image_free in libpng. A connected document ties this to the FLTK package, affecting versions less than 1.3.8-1, and states that upgrading to a later FLTK version resolves the issue. If applying this advisory, upgrade FLTK to 1.3.8-1 or newer for rem...

CVE-2019-2938

CVE-2019-2938 affects MySQL Server (InnoDB) in Oracle MySQL. Affected versions include 5.7.27 and earlier and 8.0.17 and earlier; exploitation over network could cause a hang or crash (DoS) with high privileges. CVSSv3 base score 4.4. Patches are available; advisory ALSA-2020-1333 recommends upgr...

CVE-2019-2503

The connected advisory ALAS-2019-1292 documents CVE-2019-2503 as a MySQL/MariaDB Server: Connection Handling vulnerability. Affected are Oracle MySQL Server components with versions 5.6.42 and prior, 5.7.24 and prior, and 8.0.13 and prior. The issue can allow a low-privileged attacker on the netw...

CVE-2019-16168

CVE-2019-16168 affects SQLite up to version 3.29.0, whereLoopAddBtreeIndex in sqlite3.c may crash a browser/application due to missing validation of sqlite_stat1 sz, described as a severe division by zero in the query planner. Connected documents show multiple advisories referencing the fix in SQ...

CVE-2019-5482

CVE-2019-5482 is a heap buffer overflow in curl/libcurl’s TFTP handler (tftp_receive_packet) affecting curl versions up to 7.65.3. Public advisories detail that a small TFTP blocksize can trigger overflow, potentially enabling DoS or arbitrary code execution. Public fixes exist across distributio...

CVE-2019-2537

CVE-2019-2537 affects the MySQL Server component (subcomponent: Server: DDL) of Oracle MySQL. Affected: 5.6.42 and prior, 5.7.24 and prior, 8.0.13 and prior. Description in connected docs confirms an easily exploitable, network-accessible vulnerability that can cause the MySQL Server to hang or c...

CVE-2019-14540

CVE-2019-14540 affects jackson-databind up to version 2.9.10 with serialization gadget risk involving the HikariCP classes (com.zaxxer.hikari.HikariConfig). The authoritative initial doc notes a polymorphic typing issue in jackson-databind related to HikariConfig. Connected-material references (A...

CVE-2019-2529

CVE-2019-2529 affects Oracle MySQL Server (Server: Optimizer). Affected: 5.6.42 and prior, 5.7.24 and prior, 8.0.13 and prior. Low-privilege, network-access attacker can cause a hang or complete DOS. Remediation: advisories/applicable updates exist (e.g., ALAS/CentOS/RHSA); update mariadb/mysql p...

CVE-2019-2455

CVE-2019-2455 affects the MySQL Server component (subcomponent: Server: Parser) with affected versions 5.6.42 and prior, 5.7.24 and prior, and 8.0.13 and prior. The vulnerability allows a low-privilege attacker with network access via multiple protocols to cause a hang or crash (DoS). Public advi...

CVE-2019-11068

CVE-2019-11068 affects libxslt up to 1.1.33. The vulnerability arises because xsltCheckRead/xsltCheckWrite can permit access even after a -1 error, enabling protection bypass. According to the linked advisories, this vulnerability has a CVSSv3 base score of 9.8 (NETWORK, LOW attack complexity, NO...

CVE-2019-2510

CVE-2019-2510 affects the MySQL Server component (InnoDB) of Oracle MySQL; affected versions are 5.7.24 and earlier and 8.0.13 and earlier. The vulnerability allows a high-privilege attacker with network access via multiple protocols to cause the MySQL Server to hang or crash (DOS). Public docume...

CVE-2019-2481

CVE-2019-2481 affects Oracle MySQL Server (Server: Optimizer). Affected versions are 5.6.42 and prior, 5.7.24 and prior, and 8.0.13 and prior. The vulnerability can be exploited by a high-privileged attacker over the network to cause a hang or a frequently repeating crash (complete DoS) of MySQL ...

CVE-2019-2534

CVE-2019-2534 affects Oracle MySQL Server (subcomponent: Server: Replication). Affected versions are 5.6.42 and earlier, 5.7.24 and earlier, and 8.0.13 and earlier. The vulnerability is exploitable by a low-privileged attacker with network access via multiple protocols, potentially leading to una...

CVE-2019-2975

CVE-2019-2975 affects Oracle Java SE/Scripting (and Java SE Embedded) with known affected builds: Java SE 8u221, 11.0.4, and 13; Java SE Embedded 8u221. The vulnerability concerns loading/executing untrusted code in environments like sandboxed Web Start/Applet contexts and can allow an unauthenti...

CVE-2019-2422

CVE-2019-2422 affects Oracle Java SE Libraries in Java SE 7u201, 8u192, 11.0.1 (and Java SE Embedded 8u191). The issue is a memory disclosure in FileChannelImpl that could allow an unauthenticated, network-reachable attacker to read a subset of data, with user interaction required in some context...

CVE-2019-2949

CVE-2019-2949 affects Oracle/OpenJDK Java SE Kerberos components. Affected Java SE: 7u231, 8u221, 11.0.4, 13; Java SE Embedded: 8u221. Exploitation requires network access via Kerberos and unauthenticated access could lead to leakage of sensitive data or elevated access. Connected documents show ...

CVE-2019-3822

CVE-2019-3822 affects libcurl 7.36.0 through before 7.64.0. The vulnerability is a stack-based buffer overflow in the NTLM header creation path: Curl_auth_create_ntlm_type3_message() uses unsigned arithmetic to guard a local buffer, but the check is insufficient, allowing the output data to excee...

CVE-2019-2531

CVE-2019-2531 affects the MySQL Server component (subcomponent: Server: Replication) of Oracle MySQL. Affected versions are 5.6.42 and earlier, 5.7.24 and earlier, and 8.0.13 and earlier. The vulnerability allows a high-privileged, network-access attacker to cause a hang or a frequent crash (DOS)...

CVE-2019-17531

CVE-2019-17531 affects FasterXML jackson-databind 2.0.0–2.9.10; when Default Typing is enabled for an externally exposed JSON endpoint and apache-log4j-extra 1.2.x is on the classpath, an attacker capable of providing a JNDI service can trigger remote code execution. Connected documents corrobora...

CVE-2019-2911

CVE-2019-2911 affects Oracle MySQL Server (Information Schema) and multiple affected versions (5.6.45 and prior; 5.7.27 and prior; 8.0.17 and prior). The vulnerability enables a high-privileged, network-accessible attacker via multiple protocols to read a subset of MySQL Server data. The initial ...

CVE-2019-2946

CVE-2019-2946 is a vulnerability in Oracle MySQL Server (component: Server: PS) affecting MySQL 5.7.27 and earlier and 8.0.17 and earlier. An attacker with network access and low privileges could cause a hang or crash (DoS) via multiple protocols. Public notices across advisories confirm affected...

CVE-2019-2991

CVE-2019-2991: A vulnerability in Oracle MySQL Server (Server: Optimizer) affects MySQL 8.0.x

CVE-2019-17267

Summary (CVE-2019-17267): A polymorphic typing deserialization issue in FasterXML Jackson Databind (versions prior to 2.9.10) related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup. IBM/X-Force details show a base score of 7.3 (CVSSv3) with high impact on confidentiality, integrit...

CVE-2019-2914

CVE-2019-2914 affects Oracle MySQL Server (component: Server: Security: Encryption). Affected versions: 5.7.27 and prior, 8.0.17 and prior. Exploitation requires low privileges and network access; can result in a hang or complete DoS of MySQL Server (A: HIGH). CVSS 3.0 base score 6.5 (Availabilit...

CVE-2019-2434

CVE-2019-2434 affects the Oracle MySQL Server component (subcomponent: Server: Parser). Affected versions include 5.7.24 and earlier and 8.0.13 and earlier. It is exploitable over the network by a low-privileged attacker and can cause a hang or a crash (availability impact) in MySQL Server. The C...

CVE-2019-2968

CVE-2019-2968 affects the MySQL Server, specifically the InnoDB component. Affected versions are 8.0.17 and earlier. The vulnerability can be exploited by a highly privileged attacker who has network access via multiple protocols, potentially causing a hang or a frequently repeated crash (a compl...

CVE-2019-2945

CVE-2019-2945 affects Oracle Java SE/Java SE Embedded (Networking) with affected Java SE versions 7u231, 8u221, 11.0.4, 13 and Java SE Embedded 8u221. The vulnerability can be exploited over the network by unauthenticated attackers; some vectors require user interaction and may lead to a partial ...

CVE-2019-3011

CVE-2019-3011 affects Oracle MySQL Server (Server: C API). Affected versions are 8.0.17 and prior; attacker with network access via multiple protocols can cause MySQL Server to hang or crash (DoS). Multiple connected advisories reference this CVE within the MySQL 8.0 stack (InnoDB/C API/Parser/et...

CVE-2019-2957

CVE-2019-2957 is a vulnerability in Oracle MySQL Server (Server: Security: Encryption) affecting MySQL 8.0.17 and earlier. The issue allows a highly privileged attacker who can reach the server over multiple network protocols to trigger a hang or crash (complete or frequent DOS) in MySQL Server. ...

CVE-2019-2967

CVE-2019-2967 is a vulnerability in Oracle MySQL Server (Server: Optimizer) affecting 8.0.17 and older. An attacker with low privileges and network access via multiple protocols can exploit it to cause a hang or crash (DoS). The exploit details and CVSS context are reflected across multiple advis...

CVE-2019-2420

CVE-2019-2420 is a vulnerability in the Oracle MySQL Server: Optimizer subcomponent. Affected products/versions include MySQL Server 5.7.24 and prior and 8.0.13 and prior; exploitation requires network access and high privileges, via multiple protocols, to cause a hang or frequent crash (DoS). Co...

CVE-2019-2963

CVE-2019-2963 affects Oracle MySQL Server (InnoDB). According to the supplied connected advisories, vulnerable versions are MySQL 8.0.17 and earlier. The vulnerability enables high-privilege, network-access attackers to cause the MySQL Server to hang or crash (denial of service). The documents do...

CVE-2019-3004

CVE-2019-3004 affects Oracle MySQL Server (component: Server: Parser). Affected: MySQL Server 8.0.17 and earlier. Description: a low-privilege, network-accessible attacker can cause a hang or as-needed crash (complete DOS) of MySQL Server via multiple protocols. Connected documents corroborate pr...

CVE-2019-2539

In the provided connected documents, CVE-2019-2539 is described as a vulnerability in the MySQL Server component (subcomponent: Server: Connection). Affected versions are 8.0.13 and prior. The flaw can be exploited by a highly privileged attacker with network access via multiple protocols to caus...

CVE-2019-2993

CVE-2019-2993 is a vulnerability in Oracle MySQL’s MySQL Server, specifically the Server: C API component. Affected versions include MySQL 5.7.27 and earlier and 8.0.17 and earlier. The vulnerability is described as difficult to exploit but, if exploited by a low-privilege attacker with network a...

CVE-2019-2530

CVE-2019-2530 is a vulnerability in Oracle MySQL Server (Server: Optimizer). Affected are MySQL 8.0.13 and earlier. It allows a high-privileged attacker with network access to cause a hang or a frequent crash (DoS); CVSS 3.1 base score 4.9. Remediation in advisories (e.g., RHSA-2019:2511) is to u...

CVE-2019-2966

CVE-2019-2966 affects Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.17 and earlier. It is remotely exploitable by a low-privilege attacker via multiple network protocols to cause a hang or complete denial of service of MySQL Server. Connected advisories (MiracleLin...

CVE-2019-3009

CVE-2019-3009 affects Oracle MySQL Server (Server: Connection). Affected versions are 8.0.17 and earlier. The root cause, as described in the public entry and corroborated by linked advisories, is a condition that enables a high-privilege attacker who can access the server over multiple protocols...

CVE-2019-2535

CVE-2019-2535 affects Oracle MySQL Server (subcomponent: Server: Options). From the public records, affected versions are 8.0.13 and prior. The vulnerability is described as difficult to exploit but can allow a high-privileged attacker who can log on to the host where MySQL Server runs to comprom...

CVE-2019-2973

CVE-2019-2973 is an issue in Oracle Java SE/Java SE Embedded (component: JAXP) affecting OpenJDK/OpenJDK builds such as 7u231, 8u221, 11.0.4 and 13 (and Embedded 8u221). The vulnerability allows unauthenticated network-accessed exploitation that can cause a partial denial of service in Java SE/SE...

CVE-2019-16943

CVE-2019-16943 affects FasterXML jackson-databind (versions 2.0.0–2.9.10) via a polymorphic typing flaw that, when Default Typing is enabled for an exposed JSON endpoint and a p6spy P6DataSource is present in the classpath with an accessible RMI endpoint, can lead to remote code execution. The ro...

CVE-2019-2532

CVE-2019-2532 affects Oracle MySQL Server, subcomponent Server: Security: Privileges. Affected: MySQL Server versions 5.7.24 and earlier, and 8.0.13 and earlier. Description states an easily exploitable, network-accessible vulnerability that can grant high privileges to an attacker and may cause ...

CVE-2019-3018

CVE-2019-3018 affects Oracle MySQL Server (InnoDB) with affected versions 8.0.17 and earlier. The vulnerability allows a high-privilege attacker who can reach the server over multiple protocols to cause a hang or a frequently repeatable crash (complete DOS) of MySQL Server. Root cause is tied to ...

CVE-2019-2960

CVE-2019-2960 refers to a vulnerability in Oracle MySQL Server (Server: Replication). Affected versions are MySQL 5.7.27 and prior and 8.0.17 and prior. The issue is exploitable with network access via multiple protocols by a high-privilege attacker and can lead to a hang or frequently repeatable...

CVE-2019-2982

CVE-2019-2982 affects Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.17 and earlier. The vulnerability can be exploited over the network by a highly privileged attacker via multiple protocols and may cause the MySQL Server to hang or crash (complete DOS). The issue ...

CVE-2019-2533

CVE-2019-2533 affects Oracle MySQL Server (Server: Privileges) with affected versions up to 8.0.13. The vulnerability allows a low-privileged, networked attacker to compromise MySQL Server, potentially leading to unauthorized creation, deletion or modification of data or access to all data on the...

CVE-2019-3003

CVE-2019-3003 affects Oracle MySQL Server (InnoDB) with affected versions 8.0.16 and earlier. The vulnerability is exploitable remotely over multiple protocols by a high-privilege attacker, potentially causing a hang or crash (DoS) of MySQL Server. CVSS 3.0 Base Score is 4.9 (Availability impact)...

CVE-2019-2536

CVE-2019-2536 affects the MySQL Server subcomponent “Server: Packaging” in Oracle MySQL. Affected versions are 8.0.13 and earlier. The vulnerability is described as difficult to exploit and requires a user with high privileges and user interaction, with the potential to cause a hang or a complete...