CVE-2021-27928

MariaDB and Percona Server are affected by CVE-2021-27928: an untrusted search path enables eval injection, allowing a database SUPER user to execute OS commands after altering wsrep_provider and wsrep_notify_cmd. Affected versions: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10...

CVE-2016-6662

A vulnerability exists in Oracle MySQL (through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15), MariaDB (before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17), and Percona Server (before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7). The flaw allows local u...

CVE-2016-6663

CVE-2016-6663 involves a race condition in MyISAM table repair (MySQL, MariaDB, Percona variants) that could let a local user with certain privileges gain elevated privileges via my_copystat during REPAIR TABLE. Affected products and versions include MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7....

CVE-2016-6664

CVE-2016-6664 affects Oracle MySQL, MariaDB, Percona Server and Percona XtraDB Cluster when using file-based logging. The flaw, rooted in the mysqld_safe/error log handling, could let a local user with access to the mysql account escalate to root via a symlink attack on error logs (and possibly o...

CVE-2022-34968

The CVE-2022-34968 entry concerns Percona Server for MySQL (version 8.0.28-19) with a vulnerability in the fetch_step function that can cause a Denial of Service via a crafted SQL query. The issue’s root cause is in the fetch_step logic; impact is DoS (availability) with a CVSS v3.1 base score of...

CVE-2020-26542

The CVE-2020-26542 issue affects the MongoDB Simple LDAP plugin used with Percona Server (through 2020-10-02). When using SimpleLDAP with Active Directory, authentication can succeed with a blank password, granting access at the privileges of the authenticating account. The NVD notes a high impac...

CVE-2019-12301

Percona Server 5.6.44-85.0-1 packages for Debian/Ubuntu had a password-reset issue where upgrading reset the root password to blank. This is confirmed by multiple sources (NVD, Red Hat CVE entry, Ubuntu security page). Root credentials could be effectively compromised during upgrades if exploited...