Mysql Workbench (Oracle) - vulnerabilities (CVEs)

42 CVEs, 0 in the last 30 days, 24 known versions, newest CVE from 2022-05-03. Vendor: Oracle.

CVEs of Mysql Workbench

CVE-2022-1292 - CVSS 9.8 (critical), 2022-05-03: The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a…
CVE-2022-23308 - CVSS 7.5 (high), 2022-02-26: valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
CVE-2022-21824 - CVSS 8.2 (high), 2022-02-24: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while…
CVE-2021-44532 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer…
CVE-2021-44531 - CVSS 7.4 (high), 2022-02-24: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing…
CVE-2021-44533 - CVSS 5.3 (medium), 2022-02-24: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate…
CVE-2021-3634 - CVSS 6.5 (medium), 2021-08-31: A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during the lifetime of the session. One of them…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-3517 - CVSS 8.6 (high), 2021-05-19: There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be…
CVE-2021-3518 - CVSS 8.8 (high), 2021-05-18: There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2…
CVE-2021-3537 - CVSS 5.9 (medium), 2021-05-14: A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference.…
CVE-2021-3450 - CVSS 7.4 (high), 2021-03-25: The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting…
CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
CVE-2021-20227 - CVSS 5.5 (medium), 2021-03-23: A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the…
CVE-2020-24977 - CVSS 6.5 (medium), 2020-09-04: GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in…
CVE-2020-13871 - CVSS 7.5 (high), 2020-06-06: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-1967 - CVSS 7.5 (high), 2020-04-21: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a…
CVE-2020-1730 - CVSS 5.3 (medium), 2020-04-13: A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client…
CVE-2020-11656 - CVSS 9.8 (critical), 2020-04-09: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT…
CVE-2020-11655 - CVSS 7.5 (high), 2020-04-09: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's…
CVE-2020-9327 - CVSS 7.5 (high), 2020-02-21: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column…
CVE-2020-7595 - CVSS 7.5 (high), 2020-01-21: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
CVE-2019-20388 - CVSS 7.5 (high), 2020-01-21: xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
CVE-2019-20218 - CVSS 7.5 (high), 2020-01-02: selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CVE-2019-19925 - CVSS 7.5 (high), 2019-12-24: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
CVE-2019-19923 - CVSS 7.5 (high), 2019-12-24: flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can…
CVE-2019-19924 - CVSS 5.3 (medium), 2019-12-24: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error…
CVE-2019-19926 - CVSS 7.5 (high), 2019-12-23: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this…
CVE-2019-19880 - CVSS 7.5 (high), 2019-12-18: exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses…
CVE-2019-14889 - CVSS 8.8 (high), 2019-12-10: A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the…
CVE-2019-19646 - CVSS 9.8 (critical), 2019-12-09: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CVE-2019-19603 - CVSS 7.5 (high), 2019-12-09: SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
CVE-2019-19645 - CVSS 5.5 (medium), 2019-12-09: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE…
CVE-2019-19317 - CVSS 9.8 (critical), 2019-12-05: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of…
CVE-2019-19242 - CVSS 5.9 (medium), 2019-11-27: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
CVE-2019-19244 - CVSS 7.5 (high), 2019-11-25: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
CVE-2019-10219 - CVSS 6.5 (medium), 2019-11-08: A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious…
CVE-2018-14550 - CVSS 8.8 (high), 2019-07-10: An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c…
CVE-2019-1559 - CVSS 5.9 (medium), 2019-02-27: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL…
CVE-2018-10933 - CVSS 9.1 (critical), 2018-10-17: A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first…
CVE-2018-2598 - CVSS 3.7 (low), 2018-07-18: Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption). Supported versions that are affected are…
CVE-2017-3469 - CVSS 3.7 (low), 2017-04-24: Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security : Encryption). Supported versions that are affected are…