Mysql Enterprise Monitor (Oracle) - vulnerabilities (CVEs)

58 CVEs, 0 in the last 30 days, 85 known versions, newest CVE from 2022-04-14. Vendor: Oracle.

CVEs of Mysql Enterprise Monitor

• CVE-2022-22968 - CVSS 5.3 (medium), 2022-04-14: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case…
• CVE-2022-22963 - CVSS 9.8 (critical), 2022-04-01: In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a…
• CVE-2022-22965 - CVSS 9.8 (critical), 2022-04-01: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires…
• CVE-2022-21824 - CVSS 8.2 (high), 2022-02-24: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while…
• CVE-2021-44532 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer…
• CVE-2021-44531 - CVSS 7.4 (high), 2022-02-24: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing…
• CVE-2021-44533 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate…
• CVE-2022-23181 - CVSS 7 (high), 2022-01-27: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to…
• CVE-2022-23307 - CVSS 8.8 (high), 2022-01-18: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x…
• CVE-2022-23305 - CVSS 9.8 (critical), 2022-01-18: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
• CVE-2022-23302 - CVSS 8.8 (high), 2022-01-18: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if…
• CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
• CVE-2021-4104 - CVSS 7.5 (high), 2021-12-14: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…
• CVE-2021-41182 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from…
• CVE-2021-41183 - CVSS 6.5 (medium), 2021-10-26: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from…
• CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
• CVE-2021-3711 - CVSS 9.8 (critical), 2021-08-24: In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this…
• CVE-2021-33037 - CVSS 5.3 (medium), 2021-07-12: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some…
• CVE-2021-22118 - CVSS 7.8 (high), 2021-05-27: In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by…
• CVE-2021-3450 - CVSS 7.4 (high), 2021-03-25: The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting…
• CVE-2021-25329 - CVSS 7 (high), 2021-03-01: The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a…
• CVE-2021-25122 - CVSS 7.5 (high), 2021-03-01: When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request…
• CVE-2021-22112 - CVSS 8.8 (high), 2021-02-23: Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the…
• CVE-2021-23841 - CVSS 5.9 (medium), 2021-02-16: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained…
• CVE-2020-17530 - CVSS 9.8 (critical), 2020-12-11: Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 -…
• CVE-2020-17527 - CVSS 7.5 (high), 2020-12-03: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request…
• CVE-2020-26237 - CVSS 8.7 (high), 2020-11-24: Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious…
• CVE-2020-5421 - CVSS 8.7 (high), 2020-09-19: In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD…
• CVE-2019-0233 - CVSS 7.5 (high), 2020-09-14: An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
• CVE-2019-0230 - CVSS 9.8 (critical), 2020-09-14: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
• CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
• CVE-2020-13934 - CVSS 7.5 (high), 2020-07-14: An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the…
• CVE-2020-11996 - CVSS 7.5 (high), 2020-06-26: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…
• CVE-2020-9484 - CVSS 7 (high), 2020-05-20: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
• CVE-2020-1967 - CVSS 7.5 (high), 2020-04-21: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a…
• CVE-2020-1938 - CVSS 9.8 (critical), 2020-02-24: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…
• CVE-2019-17569 - CVSS 4.8 (medium), 2020-02-24: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was…
• CVE-2020-1935 - CVSS 4.8 (medium), 2020-02-24: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed…
• CVE-2020-5397 - CVSS 5.3 (medium), 2020-01-17: Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module)…
• CVE-2019-17563 - CVSS 7.5 (high), 2019-12-23: When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could…
• CVE-2019-17571 - CVSS 9.8 (critical), 2019-12-20: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary…
• CVE-2019-1551 - CVSS 5.3 (medium), 2019-12-06: There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis…
• CVE-2019-1559 - CVSS 5.9 (medium), 2019-02-27: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL…
• CVE-2018-15756 - CVSS 7.5 (high), 2018-10-18: Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide…
• CVE-2018-11776 - CVSS 8.1 (high), 2018-08-22: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a…
• CVE-2018-11039 - CVSS 5.9 (medium), 2018-06-25: Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP…
• CVE-2018-11040 - CVSS 7.5 (high), 2018-06-25: Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain…
• CVE-2018-1258 - CVSS 8.8 (high), 2018-05-11: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An…
• CVE-2017-10424 - CVSS 8.8 (high), 2017-10-19: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Web). Supported versions that are affected are 3.2.8.2223…
• CVE-2017-12617 - CVSS 8.1 (high), 2017-10-04: When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the…
• CVE-2017-3307 - CVSS 3.1 (low), 2017-04-24: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are…
• CVE-2017-3306 - CVSS 8.3 (high), 2017-04-24: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Server). Supported versions that are affected are…
• CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…
• CVE-2016-8735 - CVSS 9.8 (critical), 2017-04-06: Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
• CVE-2016-5590 - CVSS 7.2 (high), 2017-01-27: Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Agent). Supported versions that are affected are 3.1.3.7856…
• CVE-2016-3461 - CVSS 7.2 (high), 2016-04-21: Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to…
• CVE-2015-3144 - CVSS 9 (critical), 2015-04-24: The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of…
• CVE-2013-4316 - CVSS 10 (critical), 2013-09-30: Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.